Talisman fixes

backend/app.py

@@ -103,7 +103,9 @@ def create_app():
     }
     Talisman(
         app,
-        force_https=is_https,
+        # HTTPS redirect hoort in nginx, NIET hier.
+        # Talisman zou anders redirecten naar het interne Docker adres (127.0.0.1:5000).
+        force_https=False,
         strict_transport_security=is_https,
         strict_transport_security_max_age=31536000,
         strict_transport_security_include_subdomains=True,

backend/templates/admin.html

@@ -322,7 +322,7 @@
 
 <div class="notification" id="notification"></div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
 document.addEventListener('DOMContentLoaded', async () => {
     await loadStats();
     await loadSgIct();

backend/templates/directeur.html

@@ -348,7 +348,7 @@
 
 <div class="notification" id="notification"></div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
 let teachers     = [];
 let allGoals     = {};
 let vakData      = {};

backend/templates/doelen_beheer.html

@@ -192,7 +192,7 @@
 
 </div>
 <div class="notification" id="notification"></div>
-<script>
+<script nonce="{{ csp_nonce() }}">
 document.addEventListener('DOMContentLoaded', () => {
     loadDoelen();
     switchUploadTab('xlsx');

backend/templates/leerkracht.html

@@ -351,7 +351,7 @@
 
 <div class="notification" id="notification"></div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
 // ── State ────────────────────────────────────────────────────────────────────
 let currentUser   = null;
 let currentVakId  = null;

backend/templates/login.html

@@ -311,7 +311,7 @@
         </div>
     </div>
 
-    <script>
+    <script nonce="{{ csp_nonce() }}">
         let saVisible = false;
 
         function toggleSuperadmin() {

backend/templates/scholengroep_ict.html

@@ -332,7 +332,7 @@
 
 <div class="notification" id="notification"></div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
 const IS_SUPERADMIN = {{ 'true' if is_superadmin else 'false' }};
 let schools = [];
 

backend/templates/school_ict.html

@@ -319,7 +319,7 @@
 
 <div class="notification" id="notification"></div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
 let mySchoolId = null;
 
 const ROLLEN = [

backend/templates/setup.html

@@ -254,7 +254,7 @@
         </form>
     </div>
 
-    <script>
+    <script nonce="{{ csp_nonce() }}">
         document.getElementById('setupForm').addEventListener('submit', async (e) => {
             e.preventDefault();
             const errorEl = document.getElementById('error-msg');

backend/templates/superadmin_login.html

@@ -243,7 +243,7 @@
         <a href="/auth/login" class="back-link">← Terug naar normale loginpagina</a>
     </div>
 
-    <script>
+    <script nonce="{{ csp_nonce() }}">
         document.getElementById('password').addEventListener('keydown', e => {
             if (e.key === 'Enter') doLogin();
         });