TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,76 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-100887-1774712028:
+
+======================================================================================================
+Deprecation: #100887 - Deprecation of useNonce argument in f:asset:css and f:asset:script view helpers
+======================================================================================================
+
+See :issue:`100887`
+
+Description
+===========
+
+The :html:`useNonce` argument in the :html:`f:asset.script` and
+:html:`f:asset.css` ViewHelpers has been renamed to :html:`csp` to better
+reflect its purpose (controlling Content-Security-Policy hash/nonce
+collection rather than nonce usage specifically).
+
+Similarly, the :php:`'useNonce'` asset option key accepted by
+:php:`addJavaScript()` and :php:`addStyleSheet()` in class
+:php:`\TYPO3\CMS\Core\Page\AssetCollector` has been
+replaced by :php:`'csp'`.
+
+
+Impact
+======
+
+Passing :html:`useNonce` as a ViewHelper argument or as an
+:php-short:`\TYPO3\CMS\Core\Page\AssetCollector` option key will trigger
+a deprecation-level log entry in TYPO3 v14. This usage is scheduled for
+removal in TYPO3 v15.
+
+
+Affected installations
+======================
+
+Installations with Fluid templates using :html:`<f:asset.script useNonce="1">`
+or :html:`<f:asset.css useNonce="1">`, and extensions calling
+:php:`AssetCollector::addJavaScript()` or :php:`AssetCollector::addStyleSheet()`
+with :php:`['useNonce' => true]`.
+
+
+Migration
+=========
+
+Replace the :html:`useNonce` argument with :html:`csp` in Fluid templates:
+
+..  code-block:: html
+
+    <!-- Before -->
+    <f:asset.script identifier="my-script"
+        src="EXT:my_ext/Resources/Public/JavaScript/foo.js"
+        useNonce="1" />
+
+    <!-- After -->
+    <f:asset.script identifier="my-script"
+        src="EXT:my_ext/Resources/Public/JavaScript/foo.js"
+        csp="1" />
+
+Replace the :php:`'useNonce'` option key with :php:`'csp'` in PHP:
+
+..  code-block:: php
+
+    // Before
+    $assetCollector->addJavaScript('my-script', $src, [], ['useNonce' => true]);
+
+    // After
+    $assetCollector->addJavaScript('my-script', $src, [], ['csp' => true]);
+
+The :php-short:`\TYPO3\CMS\Core\Page\PageRenderer` methods :php:`addJsInlineCode()`,
+:php:`addJsFooterInlineCode()`, and :php:`addCssInlineBlock()` retain their
+:php:`$useNonce` parameter names for backward compatibility. No migration is
+required for callers of these methods.
+
+
+..  index:: Fluid, PHP-API, PartiallyScanned, ext:core, ext:fluid