Skip to content

`TypeError: this.OCP is undefined` prohibits entering any rule

I am on NC 27.1.3 on Arch (PHP 8.2, NGINX/PHP-PFM, mariadb, Redis) and have installed CSP editor 1.2.1 for the first time today to solve an issue trying to embed a public calendar on a website. In order to rule out WordPress issues, I created a minimal static test page on that domain.

When I started, I could link to the calendar (and open it unframed), but I not embed it within that test page. Firefox's developer console said that the CSP frame ancestors does not allow it. So I added the website domain (2nd level, w/o www.) to allow for it:

grafik

However, when I click "Create" I am immediately shown a notification:

grafik

That "Error while saving custom CSP policy" is NOT reflected in nextcloud.log, the server sees no action. The developer console sees a JS error:

grafik

TypeError: this.OCP is undefined
    saveCSP https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    addCSPDomain https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    submit https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    Cn https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    n https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    _wrapper https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
csp_editor-admin-settings.js:2:3301963
    saveCSP https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    addCSPDomain https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    submit https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    Cn https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    n https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2
    _wrapper https://cloud.suevia-ka.de/apps/csp_editor/js/csp_editor-admin-settings.js?v=4e490853-76:2

The warnings are triggered by any character I enter in the domain field.

Since I wasn't able to use the UI, I checked the code and injected the setting directly into the database:

insert into oc_appconfig values (
'csp_editor',
'customCSP',
'{
  "allowedFrameAncestorDomains":
    ["https://suevia-ka.de"]
}'
);

After reloading the additional admin settings, I see the entry correctly…

grafik

…and the test page can now embed the public calendar.

So the CSP editor app logic fully works, but there's some JS glitch, at least for me. My client system: Arch Linux, Firefox 119.0.

References to further details in a GitHub issue.

Edited by Olav Seyfarth