From b3dbe128848d4f9732ae769ffc78b78a1ff929e8 Mon Sep 17 00:00:00 2001
From: rakeshkumar1019 <srakeshkumar1019@gmail.com>
Date: Fri, 23 Feb 2024 10:29:19 +0530
Subject: [PATCH] WEBUI-1446: CSP headers without the insecure unsafe-inline

---
 index.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/index.html b/index.html
index 4d6fd00122..1c14b1cb97 100644
--- a/index.html
+++ b/index.html
@@ -57,7 +57,10 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" />
 
     <!-- Content security policy (needs Nuxeo.UI.config.expressions.eval = false) -->
-    <!-- meta http-equiv="Content-Security-Policy" content="img-src data: blob: *; default-src blob: *; script-src data: * 'nonce-dummy'; style-src 'unsafe-inline' *; font-src data: *" -->
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="img-src data: blob: *; default-src blob: *; script-src data: * 'nonce-dummy'; style-src 'unsafe-inline' *; font-src data: *"
+    />
 
     <link rel="stylesheet" type="text/css" href="index.css" />
   </head>
@@ -116,7 +119,7 @@
               ],
               blob: ['appLinks', 'preview'],
             },
-            // expressions: { eval: false },
+            expressions: { eval: false },
             dateFormat: 'LL',
             dateTimeFormat: 'LLL',
             firstDayOfWeek: '',