fix: swagger missing nonce (#2116)

dpgaspar · Sep 22, 2023 · f96efda · f96efda
1 parent 74f37e2
commit f96efda
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 7 deletions.
diff --git a/flask_appbuilder/templates/appbuilder/init.html b/flask_appbuilder/templates/appbuilder/init.html
@@ -27,7 +27,7 @@
       {% endif %}
       <link href="{{url_for('appbuilder.static',filename='datepicker/bootstrap-datepicker.css')}}" rel="stylesheet">
       <link href="{{url_for('appbuilder.static',filename='select2/select2.css')}}" rel="stylesheet">
-        <link href="{{url_for('appbuilder.static',filename='select2/select2-bootstrap-theme.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='select2/select2-bootstrap-theme.css')}}" rel="stylesheet">
       <link href="{{url_for('appbuilder.static',filename='css/flags/flags16.css')}}" rel="stylesheet">
       <link href="{{url_for('appbuilder.static',filename='css/ab.css')}}" rel="stylesheet">
     {% endblock %}

diff --git a/flask_appbuilder/templates/appbuilder/swagger/swagger.html b/flask_appbuilder/templates/appbuilder/swagger/swagger.html
@@ -3,17 +3,17 @@
 {% block head_css %}
     {{ super() }}
     <link type="text/css" rel="stylesheet"
-          href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@4/swagger-ui.css">
-    <link rel="shortcut icon" href="https://fastapi.tiangolo.com/img/favicon.png">
+          href="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css"
+          nonce="{{ baselib.get_nonce() }}">
 {% endblock %}
 
 {% block content %}
     <div id="swagger-ui">
     </div>
-    <script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@4/swagger-ui-bundle.js" nonce="{{ baselib.get_nonce() }}"></script>
+    <script src="https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui-bundle.js"
+            nonce="{{ baselib.get_nonce() }}"></script>
     <!-- `SwaggerUIBundle` is now available on the page -->
-    <script>
-
+    <script nonce="{{ baselib.get_nonce() }}">
         const ui = SwaggerUIBundle({
             url: '{{openapi_uri}}',
             dom_id: '#swagger-ui',
@@ -22,7 +22,6 @@
                 SwaggerUIBundle.SwaggerUIStandalonePreset
             ],
             layout: "BaseLayout"
-
         })
     </script>
 {% endblock %}