Warn users when their source is excluded from CSP

When the CSP header is enabled but dashboards or navigation are not
included in the generated policy, editing a dashlet or navigation item
now shows an informational callout explaining that external URLs may not
render correctly and pointing the user to the Security configuration
page. Without this hint the breakage is silent and hard to connect to
the CSP settings.

Author: TheSyscall

application/forms/Dashboard/DashletForm.php

@@ -5,12 +5,16 @@
 
 namespace Icinga\Forms\Dashboard;
 
+use Icinga\Util\Csp;
 use Icinga\Web\Form;
 use Icinga\Web\Form\Validator\InternalUrlValidator;
 use Icinga\Web\Form\Validator\UrlValidator;
 use Icinga\Web\Url;
 use Icinga\Web\Widget\Dashboard;
 use Icinga\Web\Widget\Dashboard\Dashlet;
+use ipl\Web\Common\CalloutType;
+use ipl\Web\Compat\DisplayFormElement;
+use ipl\Web\Widget\Callout;
 
 /**
  * Form to add an url a dashboard pane
@@ -75,6 +79,24 @@ public function createElements(array $formData)
             ]
         );
 
+        if (Csp::isEnabled() && ! Csp::isDashboardEnabled()) {
+            $this->addElement(
+                'note',
+                'csp_warning',
+                [
+                    'decorators' => ['ViewHelper'],
+                    'value' => (new DisplayFormElement(new Callout(
+                        CalloutType::Info,
+                        $this->translate(
+                            'Any external url is not guaranteed to work as expected. '
+                            . 'Please make sure to check the Content-Security-Policy configuration.',
+                        ),
+                        $this->translate('Dashboards are not enabled in the CSP configuration'),
+                    )))->render(),
+                ]
+            );
+        }
+
         $this->addElement(
             'textarea',
             'url',

application/forms/Navigation/NavigationItemForm.php

@@ -5,8 +5,12 @@
 
 namespace Icinga\Forms\Navigation;
 
+use Icinga\Util\Csp;
 use Icinga\Web\Form;
 use Icinga\Web\Url;
+use ipl\Web\Common\CalloutType;
+use ipl\Web\Compat\DisplayFormElement;
+use ipl\Web\Widget\Callout;
 
 class NavigationItemForm extends Form
 {
@@ -48,6 +52,24 @@ public function createElements(array $formData)
             ]
         );
 
+        if (Csp::isEnabled() && ! Csp::isNavigationEnabled()) {
+            $this->addElement(
+                'note',
+                'csp_warning',
+                [
+                    'decorators' => ['ViewHelper'],
+                    'value' => (new DisplayFormElement(new Callout(
+                        CalloutType::Info,
+                        $this->translate(
+                            'Any external url is not guaranteed to work as expected. '
+                            . 'Please make sure to check the Content-Security-Policy configuration.',
+                        ),
+                        $this->translate('Navigation items are not enabled in the CSP configuration'),
+                    )))->render(),
+                ]
+            );
+        }
+
         $this->addElement(
             'textarea',
             'url',