Hello,
In the context of a website using asset_mapper and nelmio_security, I noticed that the "strict-dynamic" script-src CSP policty needed from nelmio_security was blocking the tinymce bundle's scripts from executing.
After some digging, I determined that the simplest solution was, on my end, to override the 3 twig templates containing <script> tags (form/tinymce_type.html.twig, templates/twigtinymce_editor.html.twig and templates/twig/tinymce_scripts.html.twig) and add to them nonces attributes ( nonce="{{ csp_nonce('script') }}" in my case).
This works perfectly, but I still wanted to raise the issue in the eventuality there was a way to integrate a solution in the package
Cheers !
Hello,
In the context of a website using asset_mapper and nelmio_security, I noticed that the "strict-dynamic" script-src CSP policty needed from nelmio_security was blocking the tinymce bundle's scripts from executing.
After some digging, I determined that the simplest solution was, on my end, to override the 3 twig templates containing <script> tags (form/tinymce_type.html.twig, templates/twigtinymce_editor.html.twig and templates/twig/tinymce_scripts.html.twig) and add to them nonces attributes (
nonce="{{ csp_nonce('script') }}"in my case).This works perfectly, but I still wanted to raise the issue in the eventuality there was a way to integrate a solution in the package
Cheers !