Project Management Extension - CSP Error, Script Loading Blocked

[Nuno Lopes]

After installing the Project Management extension, the screen is completely white and the CRM does not open. After a few minutes I can open it, but it keeps giving the error below and the screen is completely white.

In inspect, shows the error below, and problems loading the script.



Thanks,

Nuno Lopes

[victor]

Hi Nuno Lopes,

Please enable Debug mode: https://docs.espocrm.com/administrat...ng/#debug-mode > reproduce the error > and send the EspoCRM error log.EspoCRM log files are located in your_instance_name/data/logs/ directory. Most errors are logger there.

Additionally, tell me which browser you use for EspoCRM, the version of EspoCRM and Project Management extension?
Have you tried using an incognito browser tab that doesn't use any browser extensions (like ad blockers)?

[Nuno Lopes]

Hi victor,

I've been analyzing the log, and I don't see any errors regarding this. I use Chrome, it was tested in safari with HTTP it works with HTTPS it doesn't work.
The Project Management version is 1.1.6. When the page opens after a few minutes, when you do CTRL+F5 it stops working again for a few minutes, leaving the entire screen blank.

I tested it on a different computer, after logging in the page is completely blank, without a menu, just with a footer.

I have a subdomain with tests, and it was installed on the same machine, but with a subdomain, and I don't have this problem. Example tst.domain.com the problem does not occur but in domain.com this problem already exists.

[victor]

Do you have any code modifications on the problematic instance?
Maybe on the test instance you used only Project Management v1.1.6 and there are no other extensions? In any case, remove all extensions on the problrm instance. Then install only the official ones and see if the situation changes.

If you have a problem with removing extensions through the UI, then use these commands:

- In the folder where Espo is installed, run

bin/command extension -l

- Then copy each ID you find into

bin/command extension -u --id="extension-ID"

[Nuno Lopes]

The testing instance is exactly the same as production, all changes and extensions that exist in production come from testing first. We do not move to production before being tested in a test environment exactly the same as production.
What we find strange about this situation, because in fact the only thing that changes is just being a subdomain, because otherwise everything is the same.

[lazovic]

Hi Nuno Lopes,

If the problem is observed only on a subdomain, it makes sense to carefully review the server configuration for this subdomain. You need to compare it with the configuration for the domain where everything works.

[Nuno Lopes]

Hi lazovic,

The server is the same for both the domain and the subdomain. In the subdomain tst.domain.pt everything works flawlessly, in domain.pt it gives the error that I send in the printout. The strange thing is that after a few minutes it starts working, if I do CTRL+F5 it goes back to the same thing, the screen is completely blank with only the footer visible. By uninstalling the Project Management extension, everything is normal again.



This is very strange... Because the server is the same, the settings are the same. The error says to add lines in the code for these situations.

Nuno Lopes

[yuri]

Could you provide more details about the error?

This may be helpful:

1. CTRL+U in your browser to view the page source.
2. Take a screenshot so that line numbers were visible.
3. Upload the screenshot here so we could examine.

[yuri]

It seems that CSP errors are not related with the installed extension. Do you still have the errors in the browser console without the installed extension?

It seems that you have customized your instance by adding inline scripts which are blocked by CSP headers. You can disable CSP headers with the config parameter "clientSecurityHeadersDisabled" https://docs.espocrm.com/administrat...rams/#security

It seems that there are also other customizations producing other errors.

[Nuno Lopes]

After uninstalling the extension, the errors disappear. There are no other scripts installed, even if there were I would have to have the same error in the testing subdomain, because in both we intend to always have the same installations.
At the moment I can't do what I want, because we are talking about a machine in production, and during the day it is not a good idea to be using the machine with users working on the CRM. As soon as possible I will deactivate clientSecurityHeadersDisabled and provide feedback.

[Nuno Lopes]

Hi yuri

I'm racking my brain over this. I did another test in production last night (where there is the error), and I still have the errors that I send as an attachment. If I do F5 it refreshes the page without any problems after installing the extension, if I do CTRL+F5 the page is completely blank with just the footer and the errors attached. On Safari (Iphone 13) this problem does not occur, I uninstall the extension on the iPhone, and everything is normal again.

[victor]

On Safari (Iphone 13) this problem does not occur

Please tell me whether the browsers you use for production have any ad blockers such as AdGuard and AdBlock installed? And if so, have you tried:
- Add your production to the exclusion of these extensions?
- When tested in incognito tabs, was this extension prohibited from functioning in incognito folds?
- Have you tried using a browser that is not used for EspoCRM at all and has no extensions installed at all?