after reinstall: empty lists, template bugs

Impacted versions

• Modoboa: 1.10.2
• installer used: Yes
• Webserver: h2o

Steps to reproduce

I reinstalled modoboa, coming from a very old version (see https://github.com/modoboa/modoboa/issues/1401). In the process I recreated the whole database and copied the “old” content into the new database (aliases, domains, accounts). I’m on a very very small database.

Current behavior

modoboapython manage.py migrate at this moment shows No migrations to apply. and the frontend opens as expected. However if I go to domains or identities there are no lists. If I click anything on those sites (the links with the lists) I get to an empty template:

{"headers": "\n<th width=\"50%\" class=\"sortable\" data-sort_order=\"name\">Domain</th>\n<th class=\"sortable\" data-sort_order=\"quota\">Limit</th>\n<th class=\"sortable\" data-sort_order=\"quota_value__used\">Used</th>\n<th class=\"sortable\" data-sort_order=\"allocated_quota\">Allocated</th>\n<th class=\"sortable\" data-sort_order=\"quota_usage\" id=\"quotabar\">Verwendung (%)</th>\n", "length": 0}

[tonioo]

I guess a django app already exists for that. I’m going to close this issue but you can can open a new one regarding security headers.

[basbebe]

I already deleted the cache an logged out several times. But I found the problem.

Shame on me – it was my fault all along.

I set a Content-Security-Policy http header but I was missing the 'inline' part for script-src. This is what my header looks like and it seems to work now:

"Content-Security-Policy: default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'"

I should have checked the browser console earlier: 🙄

Maybe modoboa could utilize Content-Security-Policy headers in the future and manage this by itself? They are a valid security feature I guess.