https://www.atozed.com/forums/ Thu, 12 Nov 2026 02:54:27 +0000 MyBB https://www.atozed.com/forums/thread-6594.html Wed, 04 Nov 2026 15:13:42 -0500 lfeliz]]> https://www.atozed.com/forums/thread-6594.html https://www.atozed.com/forums/thread-6589.html Tue, 03 Nov 2026 16:24:09 -0500 PDSBILL]]> https://www.atozed.com/forums/thread-6589.html https://www.atozed.com/forums/thread-6588.html Tue, 03 Nov 2026 14:15:09 -0500 lfeliz]]> https://www.atozed.com/forums/thread-6588.html https://www.atozed.com/forums/thread-6579.html Thu, 29 Oct 2026 14:32:54 -0400 Mario Villalba]]> https://www.atozed.com/forums/thread-6579.html
I am currently working on hardening an IntraWeb application (IW 16.1.9, standalone execution) that relies on HTML Bootstrap templates and custom JavaScript/jQuery.

During a recent penetration test and security audit, the use of 'unsafe-eval' and 'unsafe-inline' in our Content Security Policy (CSP) headers was flagged as a high-risk finding.

While we are in the process of implementing dynamic request-based nonce values for external scripts and templates, we understand that IntraWeb's core rendering engine heavily relies on:

Inline event handlers (onclick, onchange, etc.) generated by native IW controls.

Async/AJAX response processing, which dynamically evaluates incoming JS snippets on the client side.

Given these architectural constraints:

Is there an official or recommended pattern to achieve strict CSP compliance within IntraWeb without breaking the core AJAX functionality?

Beyond using nonces, are there specific ServerController configs, event hooks, or best practices to eliminate or strictly limit the exposure of 'unsafe-eval' and 'unsafe-inline'?

Any insights, workarounds, or roadmap details regarding future CSP enhancements in IW 16.x would be greatly appreciated.

Thanks in advance for your guidance!

Best regards]]>
I am currently working on hardening an IntraWeb application (IW 16.1.9, standalone execution) that relies on HTML Bootstrap templates and custom JavaScript/jQuery.

During a recent penetration test and security audit, the use of 'unsafe-eval' and 'unsafe-inline' in our Content Security Policy (CSP) headers was flagged as a high-risk finding.

While we are in the process of implementing dynamic request-based nonce values for external scripts and templates, we understand that IntraWeb's core rendering engine heavily relies on:

Inline event handlers (onclick, onchange, etc.) generated by native IW controls.

Async/AJAX response processing, which dynamically evaluates incoming JS snippets on the client side.

Given these architectural constraints:

Is there an official or recommended pattern to achieve strict CSP compliance within IntraWeb without breaking the core AJAX functionality?

Beyond using nonces, are there specific ServerController configs, event hooks, or best practices to eliminate or strictly limit the exposure of 'unsafe-eval' and 'unsafe-inline'?

Any insights, workarounds, or roadmap details regarding future CSP enhancements in IW 16.x would be greatly appreciated.

Thanks in advance for your guidance!

Best regards]]> https://www.atozed.com/forums/thread-6578.html Thu, 29 Oct 2026 05:48:37 -0400 BathDragonfly]]> https://www.atozed.com/forums/thread-6578.html https://www.atozed.com/forums/thread-6575.html Wed, 28 Oct 2026 06:31:57 -0400 DidierMenant]]> https://www.atozed.com/forums/thread-6575.html
I am looking to replace the original IW icons with my own
Normaly, this should be a simple procedure, right?]]>
I am looking to replace the original IW icons with my own
Normaly, this should be a simple procedure, right?]]> https://www.atozed.com/forums/thread-6574.html Wed, 28 Oct 2026 06:30:34 -0400 DidierMenant]]> https://www.atozed.com/forums/thread-6574.html
I am looking to replace the original IW icons with my own
Normaly, this should be a simple procedure, right?]]>
I am looking to replace the original IW icons with my own
Normaly, this should be a simple procedure, right?]]> https://www.atozed.com/forums/thread-6558.html Mon, 26 Oct 2026 09:19:52 -0400 AndreasK]]> https://www.atozed.com/forums/thread-6558.html

2. One of the forms in my project is based on TIWCGJQFrame. It contains a TIWCGJQRegion with `Align = alLeft`. However, instead of being aligned to the left, it appears approximately 200–300 pixels further to the right. Everything works correctly when using an older version of CGDevTools.


Thanks, Andreas.]]>

2. One of the forms in my project is based on TIWCGJQFrame. It contains a TIWCGJQRegion with `Align = alLeft`. However, instead of being aligned to the left, it appears approximately 200–300 pixels further to the right. Everything works correctly when using an older version of CGDevTools.


Thanks, Andreas.]]> https://www.atozed.com/forums/thread-6552.html Mon, 19 Oct 2026 14:12:21 -0400 MikeComb]]> https://www.atozed.com/forums/thread-6552.html https://www.atozed.com/forums/thread-6550.html Mon, 19 Oct 2026 13:21:34 -0400 MikeComb]]> https://www.atozed.com/forums/thread-6550.html