Openbravo Issue Tracking System - POS2
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0047837POS2Corepublic2021-10-13 09:102021-11-11 07:01
Reporteralostale 
Assigned Toalostale 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0047837: index.html has inline scripts
DescriptionCore2 applications' index.html has some inline scripts. This is a discouraged practice. Its execution would be prevented if an strict CSP is put in place [1].

---
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [^]
Steps To Reproduce1. Configure app server to include CSP header by either:

a. setting it in Apache
or
b. setting it in Tomcat (ie. apply attached diff)

2. Run pos2 (in production mode)
  -> ERROR: it is not rendered
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
related to defect 0046950 closed alostale Openbravo ERP prevent image inline scripts 
blocks feature request 0047996 acknowledged Triage Platform Base POS2 make core2/pos2 CSP ready 
Attached Filesdiff tomcat-csp.diff (1,050) 2021-10-13 09:11
https://issues.openbravo.com/file_download.php?file_id=16261&type=bug
Issue History
Date ModifiedUsernameFieldChange
2021-10-13 09:10alostaleNew Issue
2021-10-13 09:10alostaleAssigned To => Retail
2021-10-13 09:10alostaleTriggers an Emergency Pack => No
2021-10-13 09:11alostaleFile Added: tomcat-csp.diff
2021-10-13 09:12alostaleRelationship addedrelated to 0046950
2021-10-13 09:17alostaleProposed Solution updated
2021-10-15 13:21hgbotNote Added: 0132365
2021-10-18 11:28guilleaerStatusnew => scheduled
2021-10-18 11:28guilleaerAssigned ToRetail => alostale
2021-11-05 07:33alostaleIssue cloned0047996
2021-11-05 07:33alostaleRelationship addedblocks 0047996
2021-11-05 07:39alostaleTypefeature request => defect
2021-11-05 07:39alostaleSummarymake core2/pos2 CSP ready => index.html has inline scripts
2021-11-05 07:39alostaleDescription Updatedbug_revision_view_page.php?rev_id=23285#r23285
2021-11-05 07:39alostaleSteps to Reproduce Updatedbug_revision_view_page.php?rev_id=23287#r23287
2021-11-05 07:39alostaleProposed Solution updated
2021-11-11 07:01hgbotNote Added: 0132947
2021-11-11 07:01hgbotResolutionopen => fixed
2021-11-11 07:01hgbotStatusscheduled => closed
2021-11-11 07:01hgbotNote Added: 0132948

Notes
(0132365)
hgbot   
2021-10-15 13:21   
Merge Request created: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/merge_requests/650 [^]
(0132947)
hgbot   
2021-11-11 07:01   
Merge request merged: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/merge_requests/650 [^]
(0132948)
hgbot   
2021-11-11 07:01   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2 [^]
Changeset: d6faee6d1115154bb728de8624a2428a178827b0
Author: Asier Lostalé <asier.lostale@openbravo.com>
Date: 2021-11-11T05:59:41+00:00
URL: https://gitlab.com/openbravo/product/pmods/org.openbravo.core2/-/commit/d6faee6d1115154bb728de8624a2428a178827b0 [^]

fixed ISSUE-47837: index.html has inline scripts

It fixes the two inline scripts that were present in index.html when
served in production mode:

1. prevents CRA to inline script in index.html

By default when CRA builds the production bundle, inlines the main
script in the index.html file.

Adding the INLINE_RUNTIME_CHUNK=false environment variable to the build
prevents this behavior importing the script from a separate file.

2. removes title setter inline script in index.html

This inline script using CRA's variable substitution to set the
application's title cannot direclty be used with the same mechanism from
js files as substitution occurs only in index.html.

Setting the title has been moved to initialization phase.

---
M src/org/openbravo/core2/build/ProductionBundleBuilder.java
M web-jspack/org.openbravo.core2/public/index.html
M web-jspack/org.openbravo.core2/src/core/AppInitializer.js
M web-jspack/org.openbravo.core2/src/core/Initialization.js
---