diff --git a/modules/markup/external/openapi.go b/modules/markup/external/openapi.go index 91230e54d02..b76b88c2969 100644 --- a/modules/markup/external/openapi.go +++ b/modules/markup/external/openapi.go @@ -72,7 +72,7 @@ func (p *openAPIRenderer) Render(ctx *markup.RenderContext, input io.Reader, out
- + `, public.AssetURI("css/swagger.css"), diff --git a/modules/markup/render.go b/modules/markup/render.go index caed3428e0b..cf5b73e7a59 100644 --- a/modules/markup/render.go +++ b/modules/markup/render.go @@ -248,7 +248,7 @@ func RenderWithRenderer(ctx *RenderContext, renderer Renderer, input io.Reader, extraLinkHref := ctx.RenderOptions.StandalonePageOptions.CurrentWebTheme.PublicAssetURI() // "`, extraScriptSrc, extraLinkHref) + extraHeadHTML = htmlutil.HTMLFormat(``, extraScriptSrc, extraLinkHref) } ctx.usedByRender = true diff --git a/modules/templates/helper.go b/modules/templates/helper.go index 3e4289c8ada..4cd6269eaf8 100644 --- a/modules/templates/helper.go +++ b/modules/templates/helper.go @@ -6,12 +6,10 @@ package templates import ( "fmt" - "html" "html/template" "net/url" "strconv" "strings" - "sync" "time" "code.gitea.io/gitea/modules/base" @@ -69,8 +67,7 @@ func newFuncMapWebPage() template.FuncMap { return strconv.FormatInt(time.Since(startTime).Nanoseconds()/1e6, 10) + "ms" }, - "AssetURI": public.AssetURI, - "ScriptImport": scriptImport, + "AssetURI": public.AssetURI, // ----------------------------------------------------------------- // setting @@ -290,30 +287,3 @@ func QueryBuild(a ...any) template.URL { } return template.URL(s) } - -var globalVars = sync.OnceValue(func() (ret struct { - scriptImportRemainingPart string -}, -) { - // add onerror handler to alert users when the script fails to load: - // * for end users: there were many users reporting that "UI doesn't work", actually they made mistakes in their config - // * for developers: help them to remember to run "make watch-frontend" to build frontend assets - // the message will be directly put in the onerror JS code's string - onScriptErrorPrompt := `Please make sure the asset files can be accessed.` - if !setting.IsProd { - onScriptErrorPrompt += `\n\nFor development, run: make watch-frontend.` - } - onScriptErrorJS := fmt.Sprintf(`alert('Failed to load asset file from ' + this.src + '. %s')`, onScriptErrorPrompt) - ret.scriptImportRemainingPart = `onerror="` + html.EscapeString(onScriptErrorJS) + `">` - return ret -}) - -func scriptImport(path string, typ ...string) template.HTML { - if len(typ) > 0 { - if typ[0] == "module" { - return template.HTML(`` + return ret +}) + +func (c TemplateContext) ScriptImport(path string, typ ...string) template.HTML { + if len(typ) > 0 { + if typ[0] == "module" { + return template.HTML(` -{{ScriptImport "js/iife.js"}} +{{ctx.ScriptImport "js/iife.js"}} diff --git a/templates/repo/diff/box.tmpl b/templates/repo/diff/box.tmpl index 390e41ec340..ffba4cf1521 100644 --- a/templates/repo/diff/box.tmpl +++ b/templates/repo/diff/box.tmpl @@ -8,7 +8,7 @@ {{svg "octicon-sidebar-collapse" 20 "icon tw-hidden"}} {{svg "octicon-sidebar-expand" 20 "icon tw-hidden"}} - {{end}} diff --git a/templates/repo/issue/view_content/pull_merge_box.tmpl b/templates/repo/issue/view_content/pull_merge_box.tmpl index 02a8db91572..814e8c6c83b 100644 --- a/templates/repo/issue/view_content/pull_merge_box.tmpl +++ b/templates/repo/issue/view_content/pull_merge_box.tmpl @@ -220,7 +220,7 @@ {{$hasPendingPullRequestMergeTip = ctx.Locale.Tr "repo.pulls.auto_merge_has_pending_schedule" .PendingPullRequestMerge.Doer.Name $createdPRMergeStr}} {{end}}
- + {{else if eq .CaptchaType "hcaptcha"}}
- + {{else if eq .CaptchaType "mcaptcha"}}
@@ -25,5 +25,5 @@
- + {{end}}{{end}} diff --git a/templates/user/dashboard/repolist.tmpl b/templates/user/dashboard/repolist.tmpl index 8b0fcbb401c..105f9566b7a 100644 --- a/templates/user/dashboard/repolist.tmpl +++ b/templates/user/dashboard/repolist.tmpl @@ -1,4 +1,4 @@ -
<script></script>
`, respSub.Body.String()) + assert.Equal(t, `
<script></script>
`, respSub.Body.String()) }) }) @@ -131,7 +131,7 @@ func TestExternalMarkupRenderer(t *testing.T) { t.Run("HTMLContentWithExternalRenderIframeHelper", func(t *testing.T) { req := NewRequest(t, "GET", "/user2/repo1/render/branch/master/html.no-sanitizer") respSub := MakeRequest(t, req, http.StatusOK) - assert.Equal(t, ``, respSub.Body.String()) + assert.Equal(t, ``, respSub.Body.String()) assert.Equal(t, "frame-src 'self'", respSub.Header().Get("Content-Security-Policy")) }) }) diff --git a/web_src/js/features/repo-issue-pull.ts b/web_src/js/features/repo-issue-pull.ts index 89f513e9711..378f8c6d7fa 100644 --- a/web_src/js/features/repo-issue-pull.ts +++ b/web_src/js/features/repo-issue-pull.ts @@ -69,6 +69,8 @@ async function initRepoPullRequestMergeForm(box: HTMLElement) { } function executeScripts(elem: HTMLElement) { + // find any existing nonce value from the current page and apply it to the new script + const scriptNonce = document.querySelector('script[nonce]')!.getAttribute('nonce')!; for (const oldScript of elem.querySelectorAll('script')) { // TODO: that's the only way to load the data for the merge form. In the future // we need to completely decouple the page data and embedded script @@ -78,6 +80,7 @@ function executeScripts(elem: HTMLElement) { if (attr.name === 'type' && attr.value === 'module') continue; newScript.setAttribute(attr.name, attr.value); } + newScript.setAttribute('nonce', scriptNonce); newScript.text = oldScript.text; document.body.append(newScript); }