Re: Making the admin compatible with CSP

2015-10-06 Thread James Bligh
I know there was previous ticket about a json filter which came to the conclusion it was too hard to do a generic one that could be used everywhere [1] For the use case where the json is going to be in a script tag that won’t be executed it seems to me like the approach in django-argonauts is per

Re: Making the admin compatible with CSP

2015-09-26 Thread James Bligh
Help would be greatly appreciated, first time contributor, not 100% sure what I’m doing. Got stuck with the test suite over the week but back on track now. There is a github repo here with my work [1]. The tests seem to be passing but I haven’t created any new ones. What is the best approach a

Re: Making the admin compatible with CSP

2015-09-14 Thread James Bligh
> On 14 Sep 2015, at 11:52, Florian Apolloner wrote: > > Makes sense, depending on the actual parameters data attributes could make > sense too for a few things. Oh, btw please do not handwrite JSON in > templates, either do it in the view or use a filter to actually create JSON > which then

Re: Making the admin compatible with CSP

2015-09-14 Thread James Bligh
On 14 September 2015 at 11:52, Florian Apolloner wrote: > > > On Monday, September 14, 2015 at 1:17:37 AM UTC+2, jasbligh wrote: >> >> I'd propose solving as follows >> 1) use the autofocus attribute when creating the form. This will work for >> IE10+ http://caniuse.com/#feat=autofocus It can als

Making the admin compatible with CSP

2015-09-13 Thread James Bligh
Ticket #15727, dealing with adding support for the Content Security Policy header, was last updated with the suggestion that the one thing should be done is to make the admin site compatible by removing inline scripts. I'd love to see this done, especially with the new design. I have done a simila