CSP violations

PHPMaker General Discussion (PHPMaker)
1

Executing inline event handler violates the following Content Security Policy directive 'script-src.....

have too many onclick() events, need to bypass this as in v2025. i could swear i had it working, then not sure if i removed something or after a regen, the scripts started failing again. inline - css is fine after un-remming the 2 csp items, but the JS is not taking effect.

is there some other cache that needs to be cleared

in the config:

        'script-src' => [
            'self' => true,
            'unsafe-inline' => true,
            'unsafe-eval' => true, // Required by JsRender

        'style-src-attr' => [
            'unsafe-inline' => true, // Required by Google charts
            'unsafe-hashes' => true,

i can't recall now what was changed to allow the js to execute..

very strange as well... i made changes to the userevents.js file, but looking at the loaded files... its not the updated version??, so not sure what's going on, even with a different browser, the JS keeps getting blocked

and i just checked the v2025 version again... and the userevents.js loaded with the correct updates and .... the jquery-confirm.js library that i use is shown in the loaded files... BUT... in the v2026 version.... its not displayed in the list and the userenvents.js does not have the same correct content.???? - i've deleted the var folders, disabled cloudflare caching

2

i added

strict-dynamic' => false

to

        'script-src' => [
            'self' => true,
            'unsafe-inline' => true,
            'unsafe-eval' => true, // Required by JsRender
            'blob' => true,
            'strict-dynamic' => false,

the site is now working, but i see this

The resource http://localhost/js/jquery-confirm.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate as value and it is preloaded intentionally.

userfn.js?v=26.14.1:1207 Uncaught TypeError: $.confirm is not a function
at userfn.js?v=26.14.1:1207:11

not sure why

3

found the issue... v2026 is using new version of jquery which dropped a few functions.
looks like this is the end of the line for jquery-confirm for me, as its not maintained, unless i make the changes to the lib to support the new jquery library