regression introduced in version 1.9.4
-
Hello SureMail team,
I’m reporting a regression introduced in version 1.9.4 that causes the dashboard to display as a completely blank white screen.
Issue:
After updating to 1.9.4, the SureMail dashboard no longer renders. The browser console shows the following Content Security Policy (CSP) error:“Content Security Policy of your site blocks the use of ‘eval’ in JavaScript”
Directive: script-src — Status: blockedRoot cause:
It appears that the internal libraries updated in 1.9.4 now useeval()(or equivalent such asnew Function(),setTimeout([string]), etc.), which is blocked by strict CSP headers. This was not an issue in version 1.9.3.Steps to reproduce:
- Install or update to SureMail 1.9.4
- Have a Content Security Policy with a strict
script-srcdirective (nounsafe-eval) - Navigate to the SureMail dashboard → blank white screen
Expected behavior:
The dashboard should render correctly regardless of CSP strictness, as it did in v1.9.3.Workaround:
Rolling back to version 1.9.3 resolves the issue.Please consider fixing the use of
eval()in the updated libraries, or documenting the CSP requirement ifunsafe-evalis now needed.Thank you for your work on this plugin.
You must be logged in to reply to this topic.