From ef08b3d48347cf5b08fa0b85519e39d62f216f82 Mon Sep 17 00:00:00 2001
From: Rob Ireton <rob@ireton.org>
Date: Thu, 24 Sep 2026 12:48:25 -0400
Subject: [PATCH] Drop the inline <style> from the shipped logo; 4.0.1

login.html {% include %}s logo.svg, so its <style> block landed on every consumer's
sign-in page and ruled out a CSP without 'unsafe-inline' in style-src for all three.
The rule set stroke-width: 0 on groups that have no stroke, and nothing on the page
gives them one, so it was a no-op: rendered before and after, the logo differs by
zero pixels.

Also fixes <svg mlns=> to xmlns=, harmless inline but invalid on its own.

A test now renders the sign-in page and fails on any inline style or script, so this
is caught here rather than only by chi-platform's audit.

Fixes #19.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CLAUDE.md                                    |  8 ++++++++
 README.md                                    | 12 ++++++++++--
 tests/test_views.py                          | 11 +++++++++++
 user_manager/__init__.py                     |  2 +-
 user_manager/templates/user_manager/logo.svg |  3 +--
 5 files changed, 31 insertions(+), 5 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 45da0c3..fe250e7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -77,6 +77,14 @@ crafted `next` cannot smuggle a second `uri` to the next hop.
 **`default_auto_field` stays `AutoField`.** The one place the estate departs from
 `conventions.md`'s `BigAutoField` rule, deliberately — see the comment in `apps.py`.
 
+## Templates
+
+**No inline styles or scripts — the logo included.** `login.html` is rendered by every
+consumer, so a single `<style>`, `style=`, `on*=` or `<script>` without `src` in it forces
+`'unsafe-inline'` into all of their CSPs. That includes `logo.svg`, which is
+`{% include %}`d rather than linked. `test_login_page_has_no_inline_style_or_script` and
+chi-platform's `no-inline-style-or-script` check both enforce it (#19).
+
 ## Tests
 
 `python runtests.py` — the suite runs standalone, with no host project. `tests/settings.py`
diff --git a/README.md b/README.md
index 108f6db..b831f39 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ example to copy from.
 Install from GitHub with pip
 
 ```shell
-pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.0"
+pip install "user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1"
 ```
 
 Check the tag against the latest release — this snippet is hand-maintained and has been
@@ -43,7 +43,7 @@ stale before.
 
 or add to a `requirements.txt` file
 ```
-user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.0
+user_manager @ git+https://github.com/Center-for-Health-Informatics/django_user_manager.git@v4.0.1
 ```
 
 Add `user_manager` app to your installed apps
@@ -383,6 +383,14 @@ MIDDLEWARE = [..., "user_manager.middleware.InspectHeadersMiddleware"]
 SPECIAL_LOG_FOLDER = "/var/log/myproject/"
 ```
 
+## Upgrading from 4.0.0 to 4.0.1
+
+- **The sign-in page no longer carries an inline `<style>`.** It came from the shipped
+  `logo.svg`, which `login.html` inlines, and it put one inline style on every consumer's
+  sign-in page — enough to rule out a `Content-Security-Policy` without `'unsafe-inline'`
+  in `style-src`. The rule was a no-op, so nothing changes on screen. No consumer changes
+  needed beyond the pin bump. (#19)
+
 ## Upgrading from 3.2 to 4.0
 
 A larger release than the version alone suggests: it closes the whole open issue queue,
diff --git a/tests/test_views.py b/tests/test_views.py
index 486e02a..dfe5878 100644
--- a/tests/test_views.py
+++ b/tests/test_views.py
@@ -1,3 +1,4 @@
+import re
 from urllib.parse import quote
 
 from django.contrib.auth import get_user_model
@@ -18,6 +19,16 @@ def test_get_renders_login_form(self):
         self.assertEqual(response.status_code, 200)
         self.assertTemplateUsed(response, "user_manager/login.html")
 
+    def test_login_page_has_no_inline_style_or_script(self):
+        """The page ships into every consumer, so one inline site forces 'unsafe-inline'
+        into all of their CSPs. That includes the logo partial, which is {% include %}d
+        (#19; chi-platform's no-inline-style-or-script check)."""
+        html = self.client.get(LOGIN_URL).content.decode()
+        inline = re.compile(
+            r"<style|\s(?:style|on[a-z]+)=[\"']|<script(?![^>]*\ssrc=)", re.IGNORECASE
+        )
+        self.assertEqual([m.group(0) for m in inline.finditer(html)], [])
+
     def test_successful_login_redirects_to_login_redirect_url(self):
         response = self.client.post(LOGIN_URL, {"username": "ada", "password": "hunter2"})
         self.assertRedirects(response, "/dashboard/", fetch_redirect_response=False)
diff --git a/user_manager/__init__.py b/user_manager/__init__.py
index ce1305b..76ad18b 100644
--- a/user_manager/__init__.py
+++ b/user_manager/__init__.py
@@ -1 +1 @@
-__version__ = "4.0.0"
+__version__ = "4.0.1"
diff --git a/user_manager/templates/user_manager/logo.svg b/user_manager/templates/user_manager/logo.svg
index 1df9935..78fdd95 100644
--- a/user_manager/templates/user_manager/logo.svg
+++ b/user_manager/templates/user_manager/logo.svg
@@ -1,6 +1,5 @@
-<svg mlns="http://www.w3.org/2000/svg" viewBox="0 0 598 269">
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 598 269">
   <title>University of Cincinnati logotype</title>
-  <defs><style>.text, .graphic {stroke-width: 0;}</style></defs>
   <g class="text">
     <g class="university">
       <path d="m24.14,139.24l.28-1.92,7.04.17,6.43-.17.28,1.92-4.67.71v22.44c0,7.15-2.92,11.93-13.86,14.46-10.83,0-14.68-5.83-14.68-14.57v-22.33l-4.95-.71.27-1.92,7.59.17,7.53-.17.28,1.92-4.67.71v23.15c0,6.82,2.91,10.72,9.18,10.72,5.72,0,8.91-3.85,8.91-10.89v-22.99l-4.95-.71Z"></path>