Skip to content

Commit 304c61c

Browse files
committed
Make sure CSP is applied to admin scripts
1 parent dc066f6 commit 304c61c

2 files changed

Lines changed: 30 additions & 0 deletions

File tree

Plugin/AddCspInlineScripts.php

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<?php declare(strict_types=1);
2+
3+
namespace Loki\AdminComponents\Plugin;
4+
5+
use Magento\Framework\View\Element\Template;
6+
use Yireo\CspUtilities\Util\ReplaceInlineScripts;
7+
8+
class AddCspInlineScripts
9+
{
10+
private readonly ReplaceInlineScripts $replaceInlineScripts;
11+
12+
public function __construct(
13+
ReplaceInlineScripts $replaceInlineScripts
14+
) {
15+
$this->replaceInlineScripts = $replaceInlineScripts;
16+
}
17+
18+
public function afterToHtml(Template $block, $html): string
19+
{
20+
if (false === str_starts_with((string)$block->getNameInLayout(), 'loki')) {
21+
return (string)$html;
22+
}
23+
24+
return $this->replaceInlineScripts->replace((string)$html);
25+
}
26+
}

etc/adminhtml/di.xml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,8 @@
33
<type name="Magento\Framework\App\FrontController">
44
<plugin name="Loki_AdminComponents::redirectLokiUrls" type="Loki\AdminComponents\Plugin\RedirectLokiUrlsPlugin"/>
55
</type>
6+
7+
<type name="Magento\Framework\View\Element\Template">
8+
<plugin name="Loki_AdminComponents::addCspInlineScripts" type="Loki\AdminComponents\Plugin\AddCspInlineScripts"/>
9+
</type>
610
</config>

0 commit comments

Comments
 (0)