From d51da8c12c2446d081eaa7f32406941b09142c1c Mon Sep 17 00:00:00 2001
From: Literallie <git@l1t.li>
Date: Sat, 21 Oct 2017 00:46:53 +0200
Subject: [PATCH] Don't add nonce to CSP if unsafe-inline is on

Browsers ignore unsafe-inline if a nonce is sent
---
 app.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app.js b/app.js
index 01ecc84..8664707 100644
--- a/app.js
+++ b/app.js
@@ -171,7 +171,9 @@ if (config.csp.enable) {
       )
     }
   }
-  directives.scriptSrc.push(getCspNonce)
+  if (directives.scriptSrc.indexOf('\'unsafe-inline\'') === -1) {
+    directives.scriptSrc.push(getCspNonce)
+  }
   directives.connectSrc.push(getCspWebSocketUrl)
   if (config.csp.upgradeInsecureRequests === 'auto') {
     directives.upgradeInsecureRequests = config.usessl === 'true'