diff --git a/libraries/src/Document/Renderer/Html/ScriptsRenderer.php b/libraries/src/Document/Renderer/Html/ScriptsRenderer.php
index fbddfa2de54c7..e8fe01416a3a7 100644
--- a/libraries/src/Document/Renderer/Html/ScriptsRenderer.php
+++ b/libraries/src/Document/Renderer/Html/ScriptsRenderer.php
@@ -256,7 +256,7 @@ private function renderInlineElement($item) : string
$buffer .= $tab . '' . $lnEnd;
+ $buffer .= '' . $lnEnd;
return $buffer;
}
diff --git a/libraries/src/Document/Renderer/Html/StylesRenderer.php b/libraries/src/Document/Renderer/Html/StylesRenderer.php
index fae8688186a0a..c130dcc8b5e75 100644
--- a/libraries/src/Document/Renderer/Html/StylesRenderer.php
+++ b/libraries/src/Document/Renderer/Html/StylesRenderer.php
@@ -250,7 +250,7 @@ private function renderInlineElement($item) : string
$buffer .= $tab . '' . $lnEnd;
+ $buffer .= '' . $lnEnd;
return $buffer;
}
diff --git a/plugins/system/httpheaders/httpheaders.php b/plugins/system/httpheaders/httpheaders.php
index 9231a55865fe5..11795b19ea4a4 100644
--- a/plugins/system/httpheaders/httpheaders.php
+++ b/plugins/system/httpheaders/httpheaders.php
@@ -174,9 +174,12 @@ public function applyHashesToCspRule(): void
// Generate the hashes for the style-src
$inlineStyles = is_array($headData['style']) ? $headData['style'] : [];
- foreach ($inlineStyles as $type => $styleContent)
+ foreach ($inlineStyles as $type => $styles)
{
- $styleHashes[] = "'sha256-" . base64_encode(hash('sha256', $styleContent, true)) . "'";
+ foreach ($styles as $hash => $styleContent)
+ {
+ $styleHashes[] = "'sha256-" . base64_encode(hash('sha256', $styleContent, true)) . "'";
+ }
}
}
@@ -413,12 +416,12 @@ private function compileAutomaticCspHeaderRules(): array
$cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['default-src'], ''));
}
- if (!isset($cspHeaderCollection['script-src']) && $nonceEnabled)
+ if (!isset($cspHeaderCollection['script-src']) && ($scriptHashesEnabled || $nonceEnabled))
{
$cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['script-src'], ''));
}
- if (!isset($cspHeaderCollection['style-src']) && $nonceEnabled)
+ if (!isset($cspHeaderCollection['style-src']) && ($scriptHashesEnabled || $nonceEnabled))
{
$cspHeaderCollection = array_merge($cspHeaderCollection, array_fill_keys(['style-src'], ''));
}