header set Content-Security-Policy "default-src 'self' 'unsafe-inline'"
to the VirtualHost configurationInstallation starts once all conditions of the "Pre-Installation Checks" are met.
If there still is a problem, a helpful message should be displayed
A popup "Process in progress. Please wait ..." comes up. Nothing else happens
Should not matter; tested with Ubuntu 12.04, Apache, Joomla 3.5.1
An additional Pre-Installation Check for good-enough Content-Security-Policy should be added.
It might simply be an additional line in the Pre-Installation Check table that shows a red "NO", which is changed into a green "YES" by some Javascript that relies on unsafe-inline
and unsafe-eval
to be present.
See also http://joomla.stackexchange.com/questions/16635/joomla-install-does-not-start
Category | ⇒ | Installation |
Labels |
Added:
?
|
Sorry but this is not something that can be changed
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2016-08-03 10:32:55 |
Closed_By | ⇒ | brianteeman |
That i know of joomla, as a whole, doesn't work without
'self' 'unsafe-eval' 'unsafe-inline'
in the js CSP rules (script-src
). And also you need'self' 'unsafe-inline'
for the CSS rules (style-src
).So if you are just using the default CSP fallback (
default-src
) the'self' 'unsafe-eval' 'unsafe-inline'
is always needed for joomla to work.But agree a js check could exist in installation and admin sys info.
Note: don't know exactly why
unsafe-eval
is needed, but theunsafe-inline
is needed for all the inline scripts/styles Joomla uses.