From 43b6c27c0a3bad1feda8ab199f5695402c621a0b Mon Sep 17 00:00:00 2001
From: oz-tal <979951+oz-tal@users.noreply.github.com>
Date: Wed, 19 Jun 2024 14:17:23 -0400
Subject: [PATCH] Set nonce attribute for inline script and style tags

Ensure the inline tags are processed if CSP headers are present and a nonce token is generated.
---
 app/views/layouts/lockup/application.html.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/views/layouts/lockup/application.html.erb b/app/views/layouts/lockup/application.html.erb
index f2ca6bb..11c9584 100644
--- a/app/views/layouts/lockup/application.html.erb
+++ b/app/views/layouts/lockup/application.html.erb
@@ -6,10 +6,10 @@
     <meta name="viewport" content="width=device-width,initial-scale = 1.0,maximum-scale = 1.0,user-scalable=no" />
 
     <title>Please enter the code word to continue&hellip;</title>
-    <style>
+    <style nonce="<%= content_security_policy_nonce %>">
       <%= render partial: 'layouts/lockup/inline_css' %>
     </style>
-    <script>
+    <script nonce="<%= content_security_policy_nonce %>">
       <%= render partial: 'layouts/lockup/inline_js' %>
     </script>
   </head>