Zammad 3.3 with CloudFlare error

InsaneSplash · March 7, 2020, 4:57pm

After upgrading from Zammad 3.2 to 3.3 on a Centos7 server, I am unable to pass the loading screen. If I disable the CloudFlare front DNS for the helpdesk, it works correctly. When using CloudFlare I now receive the below error.

Refused to load the script 'https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' 'nonce-SJQEPIlDbjGk/xoX2SFgCg=='". 'strict-dynamic' is present, so host-based whitelisting is disabled. Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Is this due to the new security changes in Zammad 3.3?

InsaneSplash · March 7, 2020, 5:03pm

An update,

I had to set a CloudFlare Page Rule to disable the rocket-loader when servicing the helpdesk.

MrGeneration · March 9, 2020, 11:08am

Just for reference the following file is responsible for this content security.
Changing it is not update safe but helps solving your issue if you want to use that js.

github.com

zammad/zammad/blob/develop/config/initializers/content_security_policy.rb

# Be sure to restart your server when you modify this file.

# Define an application-wide content security policy
# For further information see the following documentation
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

# Rails.application.config.content_security_policy do |policy|
#   policy.default_src :self, :https
#   policy.font_src    :self, :https, :data
#   policy.img_src     :self, :https, :data
#   policy.object_src  :none
#   policy.script_src  :self, :https
#   policy.style_src   :self, :https

#   # Specify URI for violation reports
#   # policy.report_uri "/csp-violation-report-endpoint"
# end

Rails.application.config.content_security_policy do |policy|
  base_uri = proc do

This file has been truncated. show original

Note that setting headers in your webservers configuration is being ignored / overwritten and thus does not help.

system · July 7, 2020, 11:10am

This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.