fixup! [WebProfilerBundle] Disable CSP if dumper was used

herndlm · herndlm · commit 448ad6fb630e · 2021-03-11T15:20:57.000+01:00
diff --git a/src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php b/src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php
@@ -92,6 +92,15 @@ public function onKernelResponse(ResponseEvent $event)
             return;
         }
 
+        $nonces = [];
+        if ($this->cspHandler) {
+            if ($this->dumpDataCollector && $this->dumpDataCollector->getDumpsCount() > 0) {
+                $this->cspHandler->disableCsp();
+            }
+
+            $nonces = $this->cspHandler->updateResponseHeaders($request, $response);
+        }
+
         // do not capture redirects or modify XML HTTP Requests
         if ($request->isXmlHttpRequest()) {
             return;
@@ -118,23 +127,14 @@ public function onKernelResponse(ResponseEvent $event)
             return;
         }
 
-        $this->injectToolbar($response, $request);
+        $this->injectToolbar($response, $request, $nonces);
     }
 
     /**
      * Injects the web debug toolbar into the given Response.
      */
-    protected function injectToolbar(Response $response, Request $request)
+    protected function injectToolbar(Response $response, Request $request, array $nonces)
     {
-        $nonces = [];
-        if ($this->cspHandler) {
-            if ($this->dumpDataCollector && $this->dumpDataCollector->getDumpsCount() > 0) {
-                $this->cspHandler->disableCsp();
-            }
-
-            $nonces = $this->cspHandler->updateResponseHeaders($request, $response);
-        }
-
         $content = $response->getContent();
         $pos = strripos($content, '</body>');
 
