3252a8 c8192e4427 fix(webapp): allow inline JSON config and Telegram widget eval under CSP ...

Add a per-request nonce to inline <script type="application/json"> blocks
(webapp-config, i18n) so they survive script-src 'self' and locales/config
actually load in the browser. Also add 'unsafe-eval' to script-src so the
vendored telegram-widget.js (which uses eval/new Function) can initialise.

2026-04-27 09:31:52 +03:00

..

app

fix(webapp): allow inline JSON config and Telegram widget eval under CSP

2026-04-27 09:31:52 +03:00

filters

Code Refactoring

2025-05-14 08:43:23 +00:00

handlers

fix(webhooks): return 5xx on YooKassa processing errors

2026-04-27 08:43:44 +03:00

keyboards/inline

feat: promocode and ref in web app

2026-04-24 13:52:53 +03:00

middlewares

feat: email login, smtp codes

2026-04-23 21:20:32 +03:00

services

refactor(logging): use logger.exception to preserve stack traces

2026-04-27 08:43:48 +03:00

states

Add admin button for delete user from bot and panel

2025-10-30 17:55:08 +03:00

utils

refactor(logging): use logger.exception to preserve stack traces

2026-04-27 08:43:48 +03:00

main_bot.py

security: harden webhooks and session secrets

2026-04-26 19:46:57 +03:00

routers.py

Refactor bot initialization and routing logic to enforce webhook mode requirement

2025-08-25 13:24:30 +03:00