Skip to content

Add CSP script-src directive and remove inline event handlers (CO-2720) #67

Merged
merged 8 commits into from
Jul 21, 2025

Conversation

arlen
Copy link
Contributor

@arlen arlen commented Jun 25, 2025

This PR also corrects slightly broken pagination controls (because these were commingled with inline event handlers) and adds the .editorconfig file for convenience (particularly with trailing space handling).

Copy link
Contributor

@Ioannis Ioannis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@arlen
Copy link
Contributor Author

arlen commented Jul 16, 2025

Commit (f2f4f22) was to revert a change I was introducing in this PR. It was a small change, but it shouldn't be included here.

The problem I was attempting to solve: In some cases, when adding an object where subnavigation is exposed, clicking a subnav tab can throw an error if the tab leads to a child of the object currently being added -- because it doesn't exist yet. I was considering turning off subnavigation on the "add" action - but that was shortsighted. There are "add" actions that take place on the subnav tabs themselves, and it's better that these add forms exist in the subnavigation context for continuity and context clues.

Instead, we would do better to keep the subnav but disable a tab's link when this problem occurs.

EDIT: I'm working on a fix for this that aligns with how the fields-nav.inc file was handled (which I missed in this refactoring).

@arlen
Copy link
Contributor Author

arlen commented Jul 16, 2025

Commit 2eda4f0 fixes subnavigation to align with how it was handled prior to refactoring. This also allows us to use $banners in fields.inc (as we can in columns.inc).

@arlen arlen merged commit 8327217 into COmanage:develop Jul 21, 2025
@arlen arlen deleted the feature-co2720-cspScriptSrc branch July 21, 2025 19:02
Sign in to join this conversation on GitHub.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants