[HELP] NC 25 script-src inline block

ℹ️ Support
1

Nextcloud version : 25.0.0
Operating system and version : Debian 11
Apache or nginx version: Apache 2
PHP version: 7.4

The issue you are facing:
12 javascripts in “Files” app
are blocked by Chrome/Firefox

Is this the first time you’ve seen this error? YES

Steps to replicate it:

  1. Enter in files section

OUTPUT IN Browser Console Log

Content Security Policy: Loading a resource on inline has been blocked by page settings (“script-src”).

2

Welcome to the community @Omar :handshake:

please add details regarding you installation e.g. if you user https and reverse proxy and provide related (browser) logs.

3

Thanks,
first of all sorry for my english.

I use always HTTPS

The error appears on different server (some with apache, other on nginx proxy)

By the way the error is caused by NC php code; it returns header policy that blocked inline js.
I found inline js into some of html page of “Files” app

Console log of Chrome and Firefox writes
“Content Security Policy: Loading a resource on inline has been blocked by page settings (“script-src”).”

4

This is the js code writen “inline” into html page
It is blocked by security policy

var _oc_debug=false;
var _oc_isadmin=false;
var backendAllowsPasswordConfirmation=true;
var oc_dataURL=false;
var _oc_webroot="";
var _oc_appswebroots={"activity":"/apps/activity","calendar":"/apps/calendar","cloud_federation_api":"/apps/cloud_federation_api","contacts":"/apps/contacts","contactsinteraction":"/apps/contactsinteraction","dav":"/apps/dav","federatedfilesharing":"/apps/federatedfilesharing","files":"/apps/files","files_accesscontrol":"/apps/files_accesscontrol","files_lock":"/apps/files_lock","files_rightclick":"/apps/files_rightclick","files_sharing":"/apps/files_sharing","files_trashbin":"/apps/files_trashbin","files_versions":"/apps/files_versions","groupfolders":"/apps/groupfolders","lookup_server_connector":"/apps/lookup_server_connector","notifications":"/apps/notifications","oauth2":"/apps/oauth2","provisioning_api":"/apps/provisioning_api","related_resources":"/apps/related_resources","settings":"/apps/settings","tasks":"/apps/tasks","text":"/apps/text","theming":"/apps/theming","twofactor_backupcodes":"/apps/twofactor_backupcodes","twofactor_totp":"/apps/twofactor_totp","updatenotification":"/apps/updatenotification","viewer":"/apps/viewer","workflowengine":"/apps/workflowengine"};
var datepickerFormatDate="dd\/MM\/yy";
var nc_lastLogin=1666362039;
var nc_pageLoad=1666362045;
var dayNames=["Domenica","Luned\u00ec","Marted\u00ec","Mercoled\u00ec","Gioved\u00ec","Venerd\u00ec","Sabato"];
var dayNamesShort=["Dom.","Lun.","Mar.","Mer.","Gio.","Ven.","Sab."];
var dayNamesMin=["Do","Lu","Ma","Me","Gi","Ve","Sa"];
var monthNames=["Gennaio","Febbraio","Marzo","Aprile","Maggio","Giugno","Luglio","Agosto","Settembre","Ottobre","Novembre","Dicembre"];
var monthNamesShort=["Gen.","Feb.","Mar.","Apr.","Mag.","Giu.","Lug.","Ago.","Set.","Ott.","Nov.","Dic."];
var firstDay=1;
var _oc_config={"session_lifetime":1440,"session_keepalive":true,"auto_logout":false,"version":"25.0.0.18","versionstring":"25.0.0","enable_avatars":true,"lost_password_link":null,"modRewriteWorking":true,"sharing.maxAutocompleteResults":25,"sharing.minSearchStringLength":0,"blacklist_files_regex":"\\.(part|filepart)$","loglevel":2};
var oc_appconfig={"core":{"defaultExpireDateEnabled":false,"defaultExpireDate":null,"defaultExpireDateEnforced":null,"enforcePasswordForPublicLink":false,"enableLinkPasswordByDefault":false,"sharingDisabledForUser":false,"resharingAllowed":false,"remoteShareAllowed":false,"federatedCloudShareDoc":"https:\/\/docs.nextcloud.com\/server\/25\/go.php?to=user-sharing-federated","allowGroupSharing":false,"defaultInternalExpireDateEnabled":false,"defaultInternalExpireDate":null,"defaultInternalExpireDateEnforced":null,"defaultRemoteExpireDateEnabled":false,"defaultRemoteExpireDate":null,"defaultRemoteExpireDateEnforced":null},"files":{"max_chunk_size":10485760}};
var _theme={"entity":"Cloud REMOVED","name":"Cloud REMOVED","productName":"Nextcloud","title":"Cloud REMOVED","baseUrl":"https:\/\/cloud.REMOVED.it","syncClientUrl":"https:\/\/nextcloud.com\/install\/#install-clients","docBaseUrl":"https:\/\/docs.nextcloud.com","docPlaceholderUrl":"https:\/\/docs.nextcloud.com\/server\/25\/go.php?to=PLACEHOLDER","slogan":"Piattaforma NextCloud su sistemi REMOVED","logoClaim":"","folder":""};
var oc_userconfig={"avatar":{"version":3,"generated":true}};