peter/ukaiautomation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSS not loading due to CSP blocking onload inline event handler

Browse Source 
The media=print onload deferred CSS pattern requires unsafe-inline in
script-src. When nonces replaced unsafe-inline in 14f1e53, the onload
attribute was blocked by CSP, leaving main.min.css as media=print only
so all below-fold styles were invisible.

Fix: replace onload attribute with a nonce-tagged inline script that
does the same media switch — CSP-safe.
This commit is contained in:
Peter Foster
2026-03-22 19:21:45 +00:00
parent 6cff10baba
commit 5d490ac91e
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
index.php
View File

@@ -142,8 +142,9 @@ $twitter_card_image = "https://ukaiautomation.co.uk/assets/images/ukaiautomation
</style> </style>
<!-- Styles --> <!-- Styles -->
<link rel="stylesheet" href="/assets/css/main.min.css?v=1.1.4" media="print" onload="this.media='all'"> <link rel="stylesheet" id="main-css" href="/assets/css/main.min.css?v=1.1.4" media="print">
<noscript><link rel="stylesheet" href="assets/css/main.min.css?v=1.1.4"></noscript> <noscript><link rel="stylesheet" href="/assets/css/main.min.css?v=1.1.4"></noscript>
<script nonce="<?php echo $nonce; ?>">(function(){var l=document.getElementById('main-css');if(l.sheet){l.media='all';}else{l.addEventListener('load',function(){this.media='all';});}})();</script>
<!-- Enhanced Local SEO Schema --> <!-- Enhanced Local SEO Schema -->
<script type="application/ld+json" nonce="<?php echo $nonce; ?>"> <script type="application/ld+json" nonce="<?php echo $nonce; ?>">