Content-Security-Policy: The page’s settings blocked an inline script

[Riad]

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src 'self' 'nonce-a40c5d449d7c0a7ee2cd9978d392ef59' 'unsafe-eval' https://maps.googleapis.com” The admin settings not display in my account menu and the notifications icon not display the mention not works

[lazovic]

Hi Riad,

You may need to disable the clientCspDisabled parameter in the EspoCRM instance configuration file to get rid of this error: https://docs.espocrm.com/administrat...rams/#security.

Config parameters can be changed or added manually in the file data/config.php. Parameters can also be added to the file data/config-internal.php.

[Riad]

Thank you lazovic .

[yuri]

Note that disabling CSP increases security risks significantly. Not recommended.

[Riad]

Thank you yuri how can solve it without security risks?

[yuri]

Add to config-internal.php

  'clientCspScriptSourceList' => [
      'https://maps.googleapis.com',
  ],

If clientCspScriptSourceList is already there, add only the string.

[Riad]

Added it and make rebuild but the problem as it is.

[Riad]

Have this also "

/crm/client/modules/dynamic-checklist/lib/module-js-functions.js?r=1747057262

Status 404



VersionHTTP/2

Transferred15.72 kB (95.72 kB size)

Referrer Policystrict-origin-when-cross-origin

DNS ResolutionSystem
"