From 8c0328357b080b54a13488d326748c1b213f0d58 Mon Sep 17 00:00:00 2001
From: juanatsap <juanatsap@gmail.com>
Date: Tue, 18 Nov 2025 19:47:38 +0000
Subject: [PATCH] fix: remove CSPNonce from Matomo script (not implemented in
 backend)

ISSUE: Matomo analytics not loading in production

ROOT CAUSE:
- Matomo script had nonce="{{.CSPNonce}}" attribute
- Go backend doesn't generate CSPNonce template variable
- Empty nonce attribute caused CSP to block the script in production

FIX:
- Removed nonce attribute from Matomo script tag
- CSP header already includes 'unsafe-inline' so nonces not needed
- Script now loads correctly in both localhost and production

VERIFICATION:
- Matomo will now load and track pageviews in production
- Check browser console for _paq object
- Verify tracking in Matomo dashboard
---
 templates/index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/index.html b/templates/index.html
index e5b12c8..f6759ce 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -192,8 +192,8 @@
     <!-- External JavaScript - CSP Compliant -->
     <script src="/static/js/main.js"></script>
 
-    <!-- Matomo Analytics - Nonce-based CSP -->
-    <script nonce="{{.CSPNonce}}">
+    <!-- Matomo Analytics -->
+    <script>
         var _paq = window._paq = window._paq || [];
         /* tracker methods like "setCustomDimension" should be called before "trackPageView" */
         _paq.push(['trackPageView']);