Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Convert onclick scripts event listeners #2556

Open
samuelhwilliams opened this issue Oct 27, 2024 · 0 comments
Open

Convert onclick scripts event listeners #2556

samuelhwilliams opened this issue Oct 27, 2024 · 0 comments
Labels
bug SF python mini-sprint

Comments

@samuelhwilliams
Copy link
Contributor

samuelhwilliams commented Oct 27, 2024 •
edited
Loading

There are a number of onclick attributes that have inline javascript: https://github.com/search?q=repo%3Apallets-eco%2Fflask-admin%20onclick&type=code

These don't support CSP nonces and so may be blocked in applications that apply strict CSP rules.

We should migrate all of the onclick attributes to event listeners set up in some JS files.

See also "Refactor inline event handlers and javascript: URIs" of https://csp.withgoogle.com/docs/adopting-csp.html
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug SF python mini-sprint
Milestone
No milestone
Development

No branches or pull requests
1 participant
@samuelhwilliams