fix: build vuedraggable to avoid importing a UMD bundle which does things that are forbidden by our CSP policy

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>

Author: julien-nc

apps/dashboard/lib/Controller/DashboardController.php

@@ -15,7 +15,6 @@
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\Attribute\OpenAPI;
-use OCP\AppFramework\Http\ContentSecurityPolicy;
 use OCP\AppFramework\Http\FeaturePolicy;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\AppFramework\Services\IInitialState;
@@ -80,10 +79,6 @@ public function index(): TemplateResponse {
 			'pageTitle' => $this->l10n->t('Dashboard'),
 		]);
 
-		$csp = new ContentSecurityPolicy();
-		$csp->addAllowedScriptDomain("'unsafe-eval'");
-		$response->setContentSecurityPolicy($csp);
-
 		// For the weather widget we should allow the geolocation
 		$featurePolicy = new FeaturePolicy();
 		$featurePolicy->addAllowedGeoLocationDomain('\'self\'');

apps/dashboard/src/DashboardApp.vue

@@ -133,7 +133,9 @@ import { getCurrentUser } from '@nextcloud/auth'
 import axios from '@nextcloud/axios'
 import { loadState } from '@nextcloud/initial-state'
 import { generateOcsUrl, generateUrl } from '@nextcloud/router'
-import Draggable from 'vuedraggable'
+// import this directly so Vite builds it and we don't end up using the UMD bundle which
+// tries to run "new Function(...)" (for no good reason) which is blocked by our CSP
+import Draggable from 'vuedraggable/src/vuedraggable.js'
 import NcButton from '@nextcloud/vue/components/NcButton'
 import NcModal from '@nextcloud/vue/components/NcModal'
 import NcUserStatusIcon from '@nextcloud/vue/components/NcUserStatusIcon'