v1.7.13: switch Alpine.js to CSP build, remove unsafe-eval from CSP

2026-04-27 15:48:22 +02:00
parent 07a841615b
commit de7df3f390
4 changed files with 45 additions and 3 deletions
--- a/backend/frontend/index.html
+++ b/backend/frontend/index.html
@@ -5,7 +5,7 @@
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <title>Admin Operations Center</title>
  <link rel="stylesheet" href="/style.css?v=15" />
-  <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js"></script>
+  <script defer src="https://cdn.jsdelivr.net/npm/@alpinejs/csp@3.x.x/dist/cdn.min.js"></script>
  <script src="https://alcdn.msauth.net/browser/2.37.0/js/msal-browser.min.js" crossorigin="anonymous"></script>
 </head>
 <body>
@@ -1274,5 +1274,13 @@
      };
    }
  </script>
+  <script>
+    // Alpine CSP build requires explicit start
+    document.addEventListener('DOMContentLoaded', function () {
+      if (window.Alpine && typeof window.Alpine.start === 'function') {
+        window.Alpine.start();
+      }
+    });
+  </script>
 </body>
 </html>