[4.0]fix change undefined $cspValue to $row in method compileAutomaticCspH…

[nielsnuebel]

This PR solves the problem of an undefined variable $cspValue copied from the method setCspHeader to compileAutomaticCspHeaderRules.

[jwaisner]

@nielsnuebel Please provide test instructions for your PR.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/27835.}

[zero-24]

hmm row is only valid here: https://github.com/joomla/joomla-cms/pull/27835/files#diff-0ea3df9101b205d7c283ccf8ef68d621R359-R381 everything outside this is not correct. I agree that the current is wrong to.

[wilsonge]

I think this is supposed to be $cspHeaderValue

[nielsnuebel]

We may have to adjust the following line for a better name. https://github.com/joomla/joomla-cms/pull/27835/files#diff-0ea3df9101b205d7c283ccf8ef68d621L359

@wilsonge no it is not. It runs to the following errors when I change it to $cspHeaderValue.

[richard67]

@nielsnuebel Could you check @wilsonge 's comment above and implement the suggested change, i.e. change $row->directive to $cspHeaderValue->directive in lines 412 and 418? This should then also solve @zero-24 ' review comment.
P.S.: And provide some testing instructions please.

[nielsnuebel]

testing instructions:

1. go to backend -> system -> Content Security Policy -> Options -> enabled CSP, Mode = Detect
2. go to site and CSP will be created
3. go back to backend -> system -> Content Security Policy -> Options -> enabled CSP, Mode = Automatic
   
4. go to -> system -> Content Security Policy -> change an item status to published for Example
   
5. Set in Global Configuration error_reporting to development and now you will get some errors on frotend and one in the Backend depends [4.0][plugin][httpheaders] - array to string conversion #26505

[Quy]

Here is var_dump $cspHeaderCollection:

array(3) {
  ["default-src"]=>
  string(64) " 'unsafe-inline' 'unsafe-inline' 'unsafe-inline' 'unsafe-inline'"
  ["script-src"]=>
  string(0) ""
  ["style-src"]=>
  string(0) ""
}

and var_dump $cspHeaderkey:

string(11) "default-src"

Thus, one can assume $cspValue->directive should be $cspHeaderkey

[Quy]

Suggested change

	if ($scriptHashesEnabled && strpos($row->directive, 'script-src') === 0)
	if ($scriptHashesEnabled && strpos($cspHeaderkey, 'script-src') === 0)

[Quy]

Suggested change

	if ($styleHashesEnabled && strpos($row->directive, 'style-src') === 0)
	if ($styleHashesEnabled && strpos($cspHeaderkey, 'style-src') === 0)

[Quy]

Closing in favor of #28318