From 112b2df8af4bc5cf98992ad1ce798c01b29a6cc3 Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Sat, 7 Feb 2026 22:23:59 +0100
Subject: [PATCH] Fix some csp issues

---
 app/Http/Middleware/ContentSecurityPolicy.php    | 6 +++---
 resources/js/alpine/components/admin/features.js | 5 +++++
 resources/js/alpine/components/event-bridge.js   | 5 +++++
 resources/views/layouts/admin.blade.php          | 3 +++
 resources/views/layouts/main.blade.php           | 2 ++
 5 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/app/Http/Middleware/ContentSecurityPolicy.php b/app/Http/Middleware/ContentSecurityPolicy.php
index 51280de72..caa1d9f20 100644
--- a/app/Http/Middleware/ContentSecurityPolicy.php
+++ b/app/Http/Middleware/ContentSecurityPolicy.php
@@ -36,7 +36,7 @@ class ContentSecurityPolicy
         // Build CSP directives for non-Turnstile pages
         $directives = [
             "default-src 'self'",
-            "script-src 'self' 'nonce-{$nonce}' https://challenges.cloudflare.com https://cdn.tiny.cloud https://cdn.jsdelivr.net/ https://static.cloudflareinsights.com/ https://cdnjs.cloudflare.com/ https://unpkg.com/ https://cdn.tailwindcss.com/ https://code.jquery.com https://apis.google.com https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com blob:",
+            "script-src 'self' 'nonce-{$nonce}' 'unsafe-eval' https://challenges.cloudflare.com https://cdn.tiny.cloud https://cdn.jsdelivr.net/ https://static.cloudflareinsights.com/ https://cdnjs.cloudflare.com/ https://unpkg.com/ https://cdn.tailwindcss.com/ https://code.jquery.com https://apis.google.com https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com blob:",
             "script-src-elem 'self' 'nonce-{$nonce}' https://challenges.cloudflare.com https://cdn.tiny.cloud https://cdn.jsdelivr.net/ https://static.cloudflareinsights.com/ https://cdnjs.cloudflare.com/ https://unpkg.com/ https://cdn.tailwindcss.com/ https://code.jquery.com https://apis.google.com https://www.google.com https://www.gstatic.com https://ajax.cloudflare.com",
             "script-src-attr 'none'",
             "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net/ https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud",
@@ -44,8 +44,8 @@ class ContentSecurityPolicy
             "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com/ https://cdn.tiny.cloud data:",
             "img-src 'self' data: https: blob:",
             "connect-src 'self' https://www.google.com https://cdn.tiny.cloud https://sp.tinymce.com",
-            "frame-src 'self' https://www.google.com https://www.gstatic.com https://challenges.cloudflare.com data: blob:",
-            "child-src 'self' https://www.google.com https://challenges.cloudflare.com blob:",
+            "frame-src 'self' https://www.google.com https://www.gstatic.com https://challenges.cloudflare.com https://cdn.tiny.cloud data: blob:",
+            "child-src 'self' https://www.google.com https://challenges.cloudflare.com https://cdn.tiny.cloud blob:",
             "worker-src 'self' blob:",
             "object-src 'none'",
             "base-uri 'self'",
diff --git a/resources/js/alpine/components/admin/features.js b/resources/js/alpine/components/admin/features.js
index 85bfced78..c8a927f75 100644
--- a/resources/js/alpine/components/admin/features.js
+++ b/resources/js/alpine/components/admin/features.js
@@ -29,6 +29,11 @@ Alpine.data('tinyMceEditor', () => ({
         const script = document.createElement('script');
         script.src = 'https://cdn.tiny.cloud/1/' + apiKey + '/tinymce/8/tinymce.min.js';
         script.referrerPolicy = 'origin';
+        // Add CSP nonce for Content Security Policy compliance
+        const nonceMeta = document.querySelector('meta[name="csp-nonce"]');
+        if (nonceMeta) {
+            script.nonce = nonceMeta.content;
+        }
         script.onload = () => this._doInit();
         script.onerror = () => {
             document.querySelectorAll('#body, .tinymce-editor').forEach(ta => {
diff --git a/resources/js/alpine/components/event-bridge.js b/resources/js/alpine/components/event-bridge.js
index 669317524..60abb5cf9 100644
--- a/resources/js/alpine/components/event-bridge.js
+++ b/resources/js/alpine/components/event-bridge.js
@@ -1195,6 +1195,11 @@ document.querySelectorAll('.progress-bar').forEach(bar => {
             const script = document.createElement('script');
             script.src = 'https://cdn.tiny.cloud/1/' + apiKey + '/tinymce/7/tinymce.min.js';
             script.referrerPolicy = 'origin';
+            // Add CSP nonce for Content Security Policy compliance
+            const nonceMeta = document.querySelector('meta[name="csp-nonce"]');
+            if (nonceMeta) {
+                script.nonce = nonceMeta.content;
+            }
             script.onload = doInit;
             script.onerror = function() { console.error('Failed to load TinyMCE'); };
             document.head.appendChild(script);
diff --git a/resources/views/layouts/admin.blade.php b/resources/views/layouts/admin.blade.php
index 85e806411..a0ece24bf 100644
--- a/resources/views/layouts/admin.blade.php
+++ b/resources/views/layouts/admin.blade.php
@@ -18,6 +18,9 @@
 
     <!-- TinyMCE API Key -->
     <meta name="tinymce-api-key" content="{{ config('tinymce.api_key', 'no-api-key') }}">
+
+    <!-- CSP Nonce for dynamic script loading -->
+    <meta name="csp-nonce" content="{{ csp_nonce() }}">
 </head>
 <body class="bg-gray-100 dark:bg-gray-900 font-sans antialiased transition-colors duration-200">
     <div class="h-screen flex">
diff --git a/resources/views/layouts/main.blade.php b/resources/views/layouts/main.blade.php
index 6cb545332..f84b2e2a4 100644
--- a/resources/views/layouts/main.blade.php
+++ b/resources/views/layouts/main.blade.php
@@ -15,6 +15,8 @@
 
     <!-- Theme Preference - Set via meta tag for CSP compliance -->
     <meta name="theme-preference" content="{{ auth()->check() ? (auth()->user()->theme_preference ?? 'light') : 'light' }}">
+    <!-- CSP Nonce for dynamic script loading -->
+    <meta name="csp-nonce" content="{{ csp_nonce() }}">
     @auth
         <meta name="user-authenticated" content="true">
         <meta name="update-theme-url" content="{{ route('profile.update-theme') }}">