diff --git a/Server/admin/admin.go b/Server/admin/admin.go index bee76d56..a97cc115 100644 --- a/Server/admin/admin.go +++ b/Server/admin/admin.go @@ -3,11 +3,7 @@ package admin import ( - "bytes" - "crypto/rand" "embed" - "encoding/base64" - "fmt" "io/fs" "net/http" @@ -51,19 +47,9 @@ func NewHandler(database *db.DB, version string, hub HubBroadcaster, u *updater. } r.Get("/", func(w http.ResponseWriter, req *http.Request) { w.Header().Set("Content-Type", "text/html; charset=utf-8") - // Generate a per-request nonce for inline script/style tags, - // avoiding 'unsafe-inline' in the CSP. - nonceBytes := make([]byte, 16) - if _, err := rand.Read(nonceBytes); err != nil { - http.Error(w, "internal error", http.StatusInternalServerError) - return - } - nonce := base64.StdEncoding.EncodeToString(nonceBytes) w.Header().Set("Content-Security-Policy", - fmt.Sprintf("default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'nonce-%s'", nonce)) - // Inject nonce into the inline