From c755e6953a8f3942fe70177eea557f8f1054db10 Mon Sep 17 00:00:00 2001
From: Jacob Coffee <jacob@z7x.org>
Date: Fri, 9 Oct 2026 10:22:25 -0500
Subject: [PATCH] fix(csp): allow EthicalAds JSONP, load EthicalAds only on
 /psf/sponsors/

EthicalAds requests ad decisions as JSONP <script> tags from
server.ethicalads.io, which script-src did not allow
(PYDOTORG-PROD-1Q6). Under an enforced policy the sponsor logos on
/psf/sponsors/ would stop rendering.

The client was also loaded on every page, while the only data-ea-*
placements are rendered by list_sponsors("sponsors") on /psf/sponsors/.
Everywhere else it threw "No ad placements found". Move the script
into that page's head block, keeping the disable_tracking guard.
---
 pydotorg/settings/base.py        |  2 ++
 templates/base.html              |  7 -------
 templates/psf/sponsors-list.html | 12 ++++++++++++
 3 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/pydotorg/settings/base.py b/pydotorg/settings/base.py
index 558dfe469..efa8b2cce 100644
--- a/pydotorg/settings/base.py
+++ b/pydotorg/settings/base.py
@@ -322,6 +322,8 @@
             NONCE,
             "https://analytics.python.org",
             "https://media.ethicalads.io",
+            # EthicalAds fetches ad decisions as JSONP <script> tags
+            "https://server.ethicalads.io",
             "https://ajax.googleapis.com",
         ],
         "style-src": [
diff --git a/templates/base.html b/templates/base.html
index 826718102..d26422b01 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -20,13 +20,6 @@
     <meta name="HandheldFriendly" content="True">
     <meta name="format-detection" content="telephone=no">
 
-    {% if not request.disable_tracking %}
-    <script async
-            src="https://media.ethicalads.io/media/client/v1.4.0/ethicalads.min.js"
-            integrity="sha256-U3hKDidudIaxBDEzwGJApJgPEf2mWk6cfMWghrAa6i0= sha384-UcmsCqcNRSLW/dV3Lo1oCi2/VaurXbib6p4HyUEOeIa/4OpsrnucrugAefzVZJfI sha512-q4t1L4xEjGV2R4hzqCa41P8jrgFUS8xTb8rdNv4FGvw7FpydVj/kkxBJHOiaoxHa8olCcx1Slk9K+3sNbsM4ug=="
-            crossorigin="anonymous"
-    ></script>
-    {% endif %}
     <script src="{{ STATIC_URL }}js/libs/modernizr.js"></script>
 
     {% stylesheet 'style' %}
diff --git a/templates/psf/sponsors-list.html b/templates/psf/sponsors-list.html
index a03b78d83..4e8082882 100644
--- a/templates/psf/sponsors-list.html
+++ b/templates/psf/sponsors-list.html
@@ -4,6 +4,18 @@
 {% block page_title %}Python Software Foundation Sponsors | Python Software Foundation{% endblock %}
 {% block og_title %}Python Software Foundation Sponsors{% endblock %}
 
+{% block head %}
+{{ block.super }}
+{# EthicalAds renders the sponsor logos below; no other page has ad placements. #}
+{% if not request.disable_tracking %}
+<script async
+        src="https://media.ethicalads.io/media/client/v1.4.0/ethicalads.min.js"
+        integrity="sha256-U3hKDidudIaxBDEzwGJApJgPEf2mWk6cfMWghrAa6i0= sha384-UcmsCqcNRSLW/dV3Lo1oCi2/VaurXbib6p4HyUEOeIa/4OpsrnucrugAefzVZJfI sha512-q4t1L4xEjGV2R4hzqCa41P8jrgFUS8xTb8rdNv4FGvw7FpydVj/kkxBJHOiaoxHa8olCcx1Slk9K+3sNbsM4ug=="
+        crossorigin="anonymous"
+></script>
+{% endif %}
+{% endblock head %}
+
 {% block content %}
 
 <article class="text">