View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0030490mantisbtjavascriptpublic2022-06-07 08:522023-10-31 16:32
Reporteratrol Assigned Todregad  
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Target Version2.26.0Fixed in Version2.26.0 
Summary0030490: list.js library causing CSP violation in manage_proj_edit_page.php
Description

This was reported by @atrol in https://github.com/mantisbt/mantisbt/pull/1821#issuecomment-1147325872:

@dregad while you are on it you might want to fix a CSP violation on this page.
There are buttons in section Manage Accounts for pagination of users.
The buttons work in general, but I am seeing CSP errors in Firefox console when clicking the buttons.

The browser's console reports the following error:

Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
TagsNo tags attached.

Relationships

parent of 0030494 closeddregad list.js navigation buttons scrolling to top of page 
child of 0030551 closeddregad Project Edit Page improvements 

Activities

dregad

dregad

2022-06-07 08:53

developer   ~0066698

The problem is caused by list.js library, which is adding javascript code in the page navigation buttons' href attribute.

This is a known issue (https://github.com/javve/list.js/issues/498), which has been fixed in list.js 2.0.0. We should upgrade to the latest version.
dregad

dregad

2022-06-07 10:18

developer   ~0066702

PR https://github.com/mantisbt/mantisbt/pull/1821

Related Changesets

MantisBT: master 96ab85e3

2022-06-07 09:05

dregad


Details Diff		 Update list.js from 1.5.0 to 2.3.1

Fixes CSP violation when using navigation buttons.

Fixes 0030490		 Affected Issues
0030490
mod - core/constant_inc.php Diff File
rm - js/list-1.5.0.js Diff
rm - js/list-1.5.0.min.js Diff
add - js/list-2.3.1.js Diff File
add - js/list-2.3.1.min.js Diff File
mod - library/README.md Diff File