From 08abab6e36c0c10c5b5fc5d57a3f958d0c22848e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= Date: Tue, 16 Jun 2026 05:05:37 +0400 Subject: [PATCH] =?UTF-8?q?v0.5.138:=20CSP=20script-src-attr=20unsafe-inli?= =?UTF-8?q?ne=20=D0=B4=D0=BB=D1=8F=20onchange?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- package.json | 2 +- src/middleware/csp.js | 1 + v2/src/config/index.js | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index aaf4032..6882f3d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "ipwhitelist", - "version": "0.5.137", + "version": "0.5.138", "description": "IP WhiteList microservice for cloud provider", "main": "server.js", "scripts": { diff --git a/src/middleware/csp.js b/src/middleware/csp.js index 90f4435..75c310e 100644 --- a/src/middleware/csp.js +++ b/src/middleware/csp.js @@ -26,6 +26,7 @@ const CSP_DIRECTIVES = { defaultSrc: ["'self'"], // 'unsafe-inline' нужен пока стили и скрипты inline в EJS. scriptSrc: ["'self'", "'unsafe-inline'"], + scriptSrcAttr: ["'unsafe-inline'"], // для onchange/onclick в EJS styleSrc: ["'self'", "'unsafe-inline'"], imgSrc: ["'self'", 'data:'], // data: для SVG-иконок fontSrc: ["'self'"], diff --git a/v2/src/config/index.js b/v2/src/config/index.js index 564a571..8c73484 100644 --- a/v2/src/config/index.js +++ b/v2/src/config/index.js @@ -9,7 +9,7 @@ // ═══════════════════════════════════════════════════════════════════════════════ module.exports = { - version: '0.5.137', + version: '0.5.138', // ── IAM ────────────────────────────────────────────────────────────────── iamUrl: process.env.V2_IAM_URL || 'https://auth-api.ngcloud.ru/api/v1/auth/user',