diff options
| author | Johannes Maron <johannes@maron.family> | 2026-05-11 17:35:36 +0200 |
|---|---|---|
| committer | Jacob Walls <jacobtylerwalls@gmail.com> | 2026-05-18 21:38:07 -0700 |
| commit | 3e4e0db66961a48a080ff3ff91f6c0d954261366 (patch) | |
| tree | af88763cafb19fab54308406a3312b03f8557db9 /docs | |
| parent | fbe902d4a4b8b9dcb371509b25ba8feff3852e64 (diff) | |
Fixed #36825 -- Extended admin templates so CSP nonce is included if available.
Error pages, admin, and registration templates were updated to use
`{% csp_nonce %}` on their explicit `<script>`, `<link>`, and `<style>`
HTML elements.
Co-authored-by: Antoliny0919 <antoliny0919@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/6.1.txt | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/docs/releases/6.1.txt b/docs/releases/6.1.txt index 8f7172256e..0415856c95 100644 --- a/docs/releases/6.1.txt +++ b/docs/releases/6.1.txt @@ -282,6 +282,11 @@ CSP with ``CSP.NONCE`` in a CSP policy but ``django.template.context_processors.csp`` is not configured. +* CSP nonce attributes are now added on ``<script>``, ``<style>``, and + ``<link>`` elements in admin templates and all built-in templates when the + :func:`~django.template.context_processors.csp` context processor is + configured. See :ref:`csp-nonce-config` for setup instructions. + CSRF ~~~~ |