Hi,

Long time Piwigo user here and very grateful for the efforts to update the code and feature set.

Since last winter, I've been trying to get Piwigo running on a server that has an active content security policy (CSP). However, I'm not a programmer, nor do I have a dedicated development environment, so it has been a slow and painful slog.

The biggest task has been eliminating inline source elements in the html. This includes styles applied in tags, onclick actions, javascript code, etc. I know CSP can get ignore these with "unsafe-inline", but that pretty much defeats the purpose of CSP.

Most of the fixes have been done with template extensions and modifying a copy of the Modus theme, so as not to muck around with the core code. Unfortunately, there remains one major stumbling block: Piwigo's Administration.

There are close to twenty inline style statements on the Admin Dashboard page alone. Clicking through the different sections, it looks like there are probably hundreds more. Without disabling CSP, many site admin functions won't work until/unless these are all eliminated. 

So, my request is to please keep CSP in mind as you move forward. Piwigo code and themes should have styling in .css files, javascript code in .js files, use event listeners to register user interactions, etc.   

Thanks.



Environment
Piwigo 13.8.0
Installed on 15 December 2014, 8 years 7 months 6 days ago
Operating system: Darwin
PHP: 7.4.33 (Show info) [2023-07-21 23:39:21]
MySQL: 5.5.5-10.11.2-MariaDB [2023-07-21 18:39:21]
Graphics Library: External ImageMagick 7.1.1-8
Cache size 32686.31 MB   calculated right now Refresh