From d9abb97f1c2d92feb4ff4b0e2a37102f3a036a03 Mon Sep 17 00:00:00 2001
From: Bibi <bibi@bibi.nu>
Date: Fri, 3 Jun 2022 14:44:35 +0200
Subject: [PATCH] Added separate controller for CSP.

---
 .env                                          |   5 +
 composer.lock                                 |  12 +-
 config/packages/twig.yaml                     |   3 +-
 public/css/calculation.css                    |  28 +++
 public/css/email.css                          |   4 +
 public/js/application/chart.js                |   2 -
 public/js/chart.js                            |   1 +
 public/js/test/recaptcha.js                   |   2 +-
 public/vendor.json                            |  11 +
 src/Chart/BaseChart.php                       |   2 +
 src/Controller/CspController.php              | 117 ++++++++++
 src/Controller/LogController.php              |  50 +---
 src/Controller/TestController.php             |  43 ++--
 src/Listener/ResponseListener.php             |   6 +-
 src/Mime/CspViolationEmail.php                |  29 +++
 src/Mime/NotificationEmail.php                |   8 +-
 src/Service/MailService.php                   |  11 +-
 src/Twig/FormatExtension.php                  |  42 ++--
 src/Twig/FunctionExtension.php                | 218 +++++++++---------
 src/Twig/ThemesExtension.php                  |  34 +--
 templates/about/about.html.twig               |   6 +-
 templates/base.html.twig                      |   8 +-
 .../calculation/calculation_edit.html.twig    |   8 +-
 .../calculation_edit_panel_totals.html.twig   |   2 +-
 templates/cards/card_edit.html.twig           |   2 +-
 templates/cards/card_table.html.twig          |   2 +-
 templates/chart/chart_base.html.twig          |   9 +-
 templates/emails/csp_violation.html.twig      |  37 +++
 templates/emails/notification.html.twig       |  25 +-
 templates/index/index.html.twig               |  22 +-
 templates/macros/_attributes.html.twig        |   2 +-
 templates/navigation/navigation.html.twig     |  12 +-
 .../navigation/navigation_chart.html.twig     |  30 +--
 .../navigation/navigation_data.html.twig      |  64 ++---
 .../navigation/navigation_search.html.twig    |   1 -
 .../navigation/navigation_test.html.twig      |  43 ++--
 .../navigation/navigation_tools.html.twig     |  23 +-
 .../navigation/navigation_user.html.twig      |  70 +++---
 templates/test/recaptcha.html.twig            |   6 +-
 templates/test/translate.html.twig            |   2 +-
 translations/messages.fr_CH.yaml              |   5 +
 vendor-bin/phpstan/composer.lock              |  38 +--
 vendor-bin/phpunit/composer.lock              |  12 +-
 vendor-bin/psalm/composer.lock                |  12 +-
 vendor-bin/rector/composer.lock               |  12 +-
 45 files changed, 648 insertions(+), 433 deletions(-)
 create mode 100644 src/Controller/CspController.php
 create mode 100644 src/Mime/CspViolationEmail.php
 create mode 100644 templates/emails/csp_violation.html.twig

diff --git a/.env b/.env
index ac4330b05..ababa3478 100644
--- a/.env
+++ b/.env
@@ -13,6 +13,11 @@ LOCK_DSN=flock
 DATABASE_URL=sqlite:///%kernel.project_dir%/tests/Data/db_test.sqlite
 ###< doctrine/doctrine-bundle ###
 
+###> symfony/mailer ###
+MAILER_USER_NAME=Calculation
+MAILER_USER_EMAIL=calculation@bibi.nu
+###< symfony/mailer ###
+
 ###> assets ###
 ASSET_BASE=http://127.0.0.1:8000/
 ASSET_LOCALE=http://127.0.0.1:8000/
diff --git a/composer.lock b/composer.lock
index 4b0ce3290..11e4f593e 100644
--- a/composer.lock
+++ b/composer.lock
@@ -8388,16 +8388,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v4.13.2",
+            "version": "v4.14.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077"
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/210577fe3cf7badcc5814d99455df46564f3c077",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/34bea19b6e03d8153165d8f30bba4c3be86184c1",
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1",
                 "shasum": ""
             },
             "require": {
@@ -8438,9 +8438,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v4.13.2"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v4.14.0"
             },
-            "time": "2021-11-30T19:35:32+00:00"
+            "time": "2022-05-31T20:59:12+00:00"
         },
         {
             "name": "phar-io/manifest",
diff --git a/config/packages/twig.yaml b/config/packages/twig.yaml
index 1448947b3..350dd7b9e 100644
--- a/config/packages/twig.yaml
+++ b/config/packages/twig.yaml
@@ -12,9 +12,8 @@ twig:
         app_owner_city: '%app_owner_city%'
         app_description: '%app_description%'
         app_mode: '%app_mode%'
-        mailer_user_email: '%mailer_user_email%'
         cookie_path: '%cookie_path%'
-        google_recaptcha_site_key: '%google_recaptcha_site_key%'
+        mailer_user_email: '%mailer_user_email%'
         link_dev: '%link_dev%'
         link_prod: '%link_prod%'
 
diff --git a/public/css/calculation.css b/public/css/calculation.css
index 032b39a57..bbbdc9327 100644
--- a/public/css/calculation.css
+++ b/public/css/calculation.css
@@ -2,3 +2,31 @@
 @import '../js/vendor/contextmenu/jquery.contextMenu.css';
 
 /**! compression tag for ftp-deployment */
+
+@media (min-width: 1200px) {
+    .col-xl-4 {
+        -ms-flex: initial;
+        flex: initial;
+        max-width: initial;
+        width: 100%;
+    }
+    .col-xl-8 {
+        -ms-flex: initial;
+        flex: initial;
+        max-width: initial;
+        width: 100%;
+    }
+}
+
+@media (min-width: 1400px) {
+    .col-xl-4 {
+        -ms-flex: 0 0 33.333333%;
+        flex: 0 0 33.333333%;
+        max-width: 33.333333%;
+    }
+    .col-xl-8 {
+        -ms-flex: 0 0 66.666667%;
+        flex: 0 0 66.666667%;
+        max-width: 66.666667%;
+    }
+}
diff --git a/public/css/email.css b/public/css/email.css
index c0700dbe5..119cbdc63 100644
--- a/public/css/email.css
+++ b/public/css/email.css
@@ -17,3 +17,7 @@ table.body.wrapper {
     border-right: 1px solid #f3f3f3;
     border-bottom: 1px solid #f3f3f3;
 }
+
+#csp td {
+    padding-top: 5px;
+}
diff --git a/public/js/application/chart.js b/public/js/application/chart.js
index 166710f4f..6d031a084 100644
--- a/public/js/application/chart.js
+++ b/public/js/application/chart.js
@@ -21,13 +21,11 @@ function onMonthsChange($months) {
  */
 (function ($) {
     'use strict';
-
     // tooltip
     $('#data').tooltip({
         selector: '.has-tooltip',
         customClass: 'tooltip-danger overall-datatable'
     });
-
     // handle months change
     const $months = $('#months');
     if ($months.length) {
diff --git a/public/js/chart.js b/public/js/chart.js
index 8b8294fab..cc33566c5 100644
--- a/public/js/chart.js
+++ b/public/js/chart.js
@@ -9,6 +9,7 @@
  * Vendor Files
  */
 <!--#include file="vendor/highcharts/highcharts.js" -->
+<!--#include file="vendor/highcharts/accessibility.js" -->
 
 /**
  * Plugin Files
diff --git a/public/js/test/recaptcha.js b/public/js/test/recaptcha.js
index 226c5ae5b..66c825f0a 100644
--- a/public/js/test/recaptcha.js
+++ b/public/js/test/recaptcha.js
@@ -14,7 +14,7 @@ grecaptcha.ready(function () {
     // execute
     const $form = $('#edit-form');
     const key = $form.data('key');
-    const action = $form.attr('action');
+    const action = $form.data('action');
     grecaptcha.execute(key, {
         action: action
     }).then(function (token) {
diff --git a/public/vendor.json b/public/vendor.json
index 2ca6597b1..8ed63ce24 100644
--- a/public/vendor.json
+++ b/public/vendor.json
@@ -64,6 +64,17 @@
                 "highcharts.src.js"
             ]
         },
+        {
+            "name": "highcharts",
+            "version": "10.1.0",
+            "source": "https://cdn.jsdelivr.net/npm/",
+            "format": "{source}{name}@{version}/modules/{file}",
+            "target": "highcharts",
+            "files": [
+                "accessibility.js",
+                "accessibility.js.map"
+            ]
+        },
         {
             "name": "html5sortable",
             "version": "0.13.3",
diff --git a/src/Chart/BaseChart.php b/src/Chart/BaseChart.php
index 324311758..d0dd62ea7 100644
--- a/src/Chart/BaseChart.php
+++ b/src/Chart/BaseChart.php
@@ -72,6 +72,8 @@ class BaseChart extends Highchart
 
     /**
      * Constructor.
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     public function __construct(protected ApplicationService $application, ThemeService $service, TranslatorInterface $translator)
     {
diff --git a/src/Controller/CspController.php b/src/Controller/CspController.php
new file mode 100644
index 000000000..1f16276e6
--- /dev/null
+++ b/src/Controller/CspController.php
@@ -0,0 +1,117 @@
+<?php
+/*
+ * This file is part of the Calculation package.
+ *
+ * (c) bibi.nu <bibi@bibi.nu>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use App\Mime\CspViolationEmail;
+use App\Util\Utils;
+use Psr\Log\LoggerInterface;
+use Sensio\Bundle\FrameworkExtraBundle\Configuration\IsGranted;
+use Symfony\Bridge\Twig\Mime\NotificationEmail;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Attribute\AsController;
+use Symfony\Component\Mailer\Exception\TransportExceptionInterface;
+use Symfony\Component\Mailer\MailerInterface;
+use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+
+/**
+ * Controller to handle CSP violation.
+ */
+#[AsController]
+#[IsGranted('ROLE_USER')]
+class CspController extends AbstractController
+{
+    #[Route(path: '/csp', name: 'log_csp')]
+    public function invoke(LoggerInterface $logger, MailerInterface $mailer): Response
+    {
+        if (false !== $context = $this->getContext()) {
+            try {
+                $title = $this->trans('notification.csp_title');
+                $this->logContext($title, $context, $logger);
+                $this->sendNotification($title, $context, $mailer);
+            } catch (TransportExceptionInterface $e) {
+                $context = Utils::getExceptionContext($e);
+                $logger->error($e->getMessage(), $context);
+            }
+        }
+
+        return new Response('', Response::HTTP_NO_CONTENT);
+    }
+
+    private function explodeOriginalPolicy(string $value): array
+    {
+        $result = [];
+        $policies = \array_filter(\explode(';', $value));
+        foreach ($policies as $policy) {
+            $entries = \array_filter(\explode(' ', $policy));
+            if (\count($entries) > 1) {
+                $key = \reset($entries);
+                $values = \array_map(static fn (string $entry): string => \trim($entry, "'"), \array_slice($entries, 1));
+                \sort($values);
+                $result[$key] = \implode("\n", $values);
+            }
+        }
+
+        return $result;
+    }
+
+    private function getActionUrl(): string
+    {
+        return $this->generateUrl(self::HOME_PAGE, [], UrlGeneratorInterface::ABSOLUTE_URL);
+    }
+
+    private function getContext(): array|false
+    {
+        $content = (string) \file_get_contents('php://input');
+        /** @psalm-var bool|array{csp-report: string[]} $data */
+        $data = \json_decode($content, true);
+        if (\is_array($data)) {
+            $context = \array_filter($data['csp-report']);
+            if (isset($context['original-policy'])) {
+                $context['original-policy'] = $this->explodeOriginalPolicy($context['original-policy']);
+            }
+
+            return $context;
+        }
+
+        return false;
+    }
+
+    private function getFooterText(): string
+    {
+        return $this->trans('notification.footer', ['%name%' => $this->getApplicationName()]);
+    }
+
+    private function logContext(string $title, array $context, LoggerInterface $logger): void
+    {
+        $logger->error($title, $context);
+    }
+
+    /**
+     * @throws TransportExceptionInterface
+     */
+    private function sendNotification(string $title, array $context, MailerInterface $mailer): void
+    {
+        $notification = new CspViolationEmail($this->getTranslator());
+        $notification->importance(NotificationEmail::IMPORTANCE_HIGH)
+            ->subject($title)
+            ->to($this->getAddressFrom())
+            ->from($this->getAddressFrom())
+            ->setFooterText($this->getFooterText())
+            ->action($this->trans('index.title'), $this->getActionUrl())
+            ->context([
+                'context' => $context,
+            ]);
+        $mailer->send($notification);
+    }
+}
diff --git a/src/Controller/LogController.php b/src/Controller/LogController.php
index 00866102b..06a1a82f4 100644
--- a/src/Controller/LogController.php
+++ b/src/Controller/LogController.php
@@ -24,9 +24,6 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
-use Symfony\Component\Mailer\Exception\TransportExceptionInterface;
-use Symfony\Component\Mailer\MailerInterface;
-use Symfony\Component\Mime\Email;
 use Symfony\Component\Routing\Annotation\Route;
 
 /**
@@ -39,45 +36,10 @@ class LogController extends AbstractController
 {
     use TableTrait;
 
-    /**
-     * Logs a Content Security Policy report.
-     */
-    #[IsGranted('ROLE_USER')]
-    #[Route(path: '/csp', name: 'log_csp')]
-    public function cspViolation(LoggerInterface $logger, MailerInterface $mailer): Response
-    {
-        $content = (string) \file_get_contents('php://input');
-        /** @psalm-var bool|array{csp-report: string[]} $data */
-        $data = \json_decode($content, true);
-        if (\is_array($data)) {
-            $title = 'CSP Violation';
-            $csp_report = $data['csp-report'];
-            $context = \array_filter($csp_report, 'strlen');
-            if (isset($context['document-uri'])) {
-                $title .= ': ' . $context['document-uri'];
-            } elseif (isset($context['source-file'])) {
-                $title .= ': ' . $context['source-file'];
-            }
-            $logger->error($title, $context);
-
-            try {
-                $text = (string) \json_encode($context, \JSON_PRETTY_PRINT | \JSON_UNESCAPED_SLASHES);
-                $email = (new Email())
-                    ->subject($title)
-                    ->text($text);
-                $mailer->send($email);
-            } catch (TransportExceptionInterface $e) {
-                $context = Utils::getExceptionContext($e);
-                $logger->error($e->getMessage(), $context);
-            }
-        }
-
-        // no content
-        return new Response('', Response::HTTP_NO_CONTENT);
-    }
-
     /**
      * Delete the content of the log file (if any).
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     #[Route(path: '/delete', name: 'log_delete')]
     public function delete(Request $request, LogService $service, LoggerInterface $logger): Response
@@ -126,6 +88,8 @@ public function delete(Request $request, LogService $service, LoggerInterface $l
 
     /**
      * Export the logs to a Spreadsheet document.
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     #[Route(path: '/excel', name: 'log_excel')]
     public function excel(LogService $service): Response
@@ -143,6 +107,8 @@ public function excel(LogService $service): Response
 
     /**
      * Export to PDF the content of the log file.
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     #[Route(path: '/pdf', name: 'log_pdf')]
     public function pdf(LogService $service): Response
@@ -160,6 +126,8 @@ public function pdf(LogService $service): Response
 
     /**
      * Clear the log file cache.
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     #[Route(path: '/refresh', name: 'log_refresh')]
     public function refresh(Request $request, LogService $service): Response
@@ -172,6 +140,8 @@ public function refresh(Request $request, LogService $service): Response
 
     /**
      * Show properties of a log entry.
+     *
+     * @throws \Psr\Cache\InvalidArgumentException
      */
     #[Route(path: '/show/{id}', name: 'log_show', requirements: ['id' => self::DIGITS])]
     public function show(Request $request, int $id, LogService $service): Response
diff --git a/src/Controller/TestController.php b/src/Controller/TestController.php
index 51618338b..9d1c5314b 100644
--- a/src/Controller/TestController.php
+++ b/src/Controller/TestController.php
@@ -58,7 +58,6 @@
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Contracts\Translation\TranslatorInterface;
 
 /**
  * Controller for tests.
@@ -315,7 +314,7 @@ public function password(Request $request, CaptchaImageService $service): Respon
      * Display the reCaptcha.
      */
     #[Route(path: '/recaptcha', name: 'test_recaptcha')]
-    public function recaptcha(Request $request, TranslatorInterface $translator): Response
+    public function recaptcha(Request $request, bool $isDebug): Response
     {
         $data = [
             'subject' => 'My subject',
@@ -328,10 +327,8 @@ public function recaptcha(Request $request, TranslatorInterface $translator): Re
 
         $helper->field('subject')
             ->addTextType();
-
         $helper->field('message')
             ->addTextType();
-
         $helper->field('recaptcha')
             ->addHiddenType();
 
@@ -341,52 +338,56 @@ public function recaptcha(Request $request, TranslatorInterface $translator): Re
             /** @psalm-var array $data */
             $data = $form->getData();
             $response = (string) $data['recaptcha'];
-            $hostname = (string) $request->server->get('HTTP_HOST');
+            $hostname = (string) $request->server->get('SERVER_NAME');
+            $remoteIp = (string) $request->server->get('REMOTE_ADDR');
             $secret = $this->getStringParameter('google_recaptcha_secret_key');
+            $expectedHostName = $isDebug ? $remoteIp : $hostname;
 
             // verify
             $recaptcha = new ReCaptcha($secret);
-            $recaptcha->setExpectedAction($action)
-                ->setExpectedHostname($hostname)
+            $recaptcha->setExpectedHostname($expectedHostName)
+                ->setExpectedAction($action)
                 ->setChallengeTimeout(60)
                 ->setScoreThreshold(0.5);
-            $result = $recaptcha->verify($response);
+            $result = $recaptcha->verify($response, $remoteIp);
 
             // OK?
             if ($result->isSuccess()) {
                 /** @psalm-var array<string, mixed> $values */
                 $values = $result->toArray();
-                $html = '<table class="table table-sm table-borderless alert-heading">';
+                $html = '<table class="table table-borderless table-sm mb-0">';
 
                 /** @psalm-var string[]|string|null $value */
                 foreach ($values as $key => $value) {
-                    if (null !== $value) {
-                        if (\is_array($value)) {
-                            $value = \implode('<br>', $value);
-                        } elseif ('challenge_ts' === $key && false !== $time = \strtotime($value)) {
-                            $value = FormatUtils::formatDateTime($time, null, \IntlDateFormatter::MEDIUM);
-                        }
-                        $html .= "<tr><td>$key<td><td>:</td><td>$value</td></tr>";
+                    if (empty($value)) {
+                        continue;
                     }
+                    if (\is_array($value)) {
+                        $value = \implode('<br>', $value);
+                    } elseif ('challenge_ts' === $key && false !== $time = \strtotime($value)) {
+                        $value = FormatUtils::formatDateTime($time, null, \IntlDateFormatter::MEDIUM);
+                    }
+                    $html .= "<tr><td>$key</td><td>:</td><td>$value</td></tr>";
                 }
                 $html .= '</table>';
-                $this->success('reCAPTCHA|' . $html);
+                $this->success($html);
 
                 return $this->redirectToHomePage();
             }
 
-            $errorCodes = \array_map(fn (mixed $code): string => $translator->trans("recaptcha.$code", [], 'validators'), $result->getErrorCodes());
+            // add errors
+            $errorCodes = \array_map(fn (mixed $code): string => $this->trans("recaptcha.$code", [], 'validators'), $result->getErrorCodes());
             if (empty($errorCodes)) {
-                $errorCodes[] = $translator->trans('recaptcha.unknown-error', [], 'validators');
+                $errorCodes[] = $this->trans('recaptcha.unknown-error', [], 'validators');
             }
-
             foreach ($errorCodes as $code) {
                 $form->addError(new FormError($code));
             }
         }
 
         return $this->renderForm('test/recaptcha.html.twig', [
-            'recaptcha_action' => $action,
+            'google_recaptcha_site_key' => $this->getStringParameter('google_recaptcha_site_key'),
+            'google_recaptcha_action' => $action,
             'form' => $form,
         ]);
     }
diff --git a/src/Listener/ResponseListener.php b/src/Listener/ResponseListener.php
index cf75d05b9..40b87898d 100644
--- a/src/Listener/ResponseListener.php
+++ b/src/Listener/ResponseListener.php
@@ -21,7 +21,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\ResponseEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
-use Symfony\Component\Routing\RouterInterface;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 
 /**
  * Response subscriber to add content security policy (CSP).
@@ -55,12 +55,12 @@ class ResponseListener implements EventSubscriberInterface
     /**
      * Constructor.
      */
-    public function __construct(ParameterBagInterface $params, RouterInterface $router, NonceExtension $extension, string $file, private readonly bool $isDebug)
+    public function __construct(ParameterBagInterface $params, UrlGeneratorInterface $router, NonceExtension $extension, string $file, private readonly bool $isDebug)
     {
         /** @var string $asset */
         $asset = $params->get('asset_base');
         $nonce = "'nonce-" . $extension->getNonce() . "'";
-        $report = $router->generate('log_csp');
+        $report = $router->generate('log_csp', [], UrlGeneratorInterface::ABSOLUTE_URL);
         $this->csp = $this->loadCSP($file, $asset, $nonce, $report);
     }
 
diff --git a/src/Mime/CspViolationEmail.php b/src/Mime/CspViolationEmail.php
new file mode 100644
index 000000000..85847d980
--- /dev/null
+++ b/src/Mime/CspViolationEmail.php
@@ -0,0 +1,29 @@
+<?php
+/*
+ * This file is part of the Calculation package.
+ *
+ * (c) bibi.nu <bibi@bibi.nu>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace App\Mime;
+
+use Symfony\Component\Mime\Header\Headers;
+use Symfony\Component\Mime\Part\AbstractPart;
+use Symfony\Contracts\Translation\TranslatorInterface;
+
+/**
+ * Notification email for CSP violation.
+ */
+class CspViolationEmail extends NotificationEmail
+{
+    public function __construct(TranslatorInterface $translator, Headers $headers = null, AbstractPart $body = null)
+    {
+        parent::__construct($translator, $headers, $body);
+        $this->htmlTemplate('emails/csp_violation.html.twig');
+    }
+}
diff --git a/src/Mime/NotificationEmail.php b/src/Mime/NotificationEmail.php
index 9f80fd6e7..d3086ced6 100644
--- a/src/Mime/NotificationEmail.php
+++ b/src/Mime/NotificationEmail.php
@@ -19,7 +19,7 @@
 use Symfony\Contracts\Translation\TranslatorInterface;
 
 /**
- * Extends NotificationEmail to use translated subjet.
+ * Extends NotificationEmail to use translated subject.
  */
 class NotificationEmail extends BaseNotificationEmail
 {
@@ -30,18 +30,16 @@ class NotificationEmail extends BaseNotificationEmail
     public function __construct(?TranslatorInterface $translator, Headers $headers = null, AbstractPart $body = null)
     {
         parent::__construct($headers, $body);
-        $this->htmlTemplate('emails/notification.html.twig');
         if (null !== $translator) {
             $this->setTranslator($translator);
         }
+        $this->htmlTemplate('emails/notification.html.twig');
     }
 
     public function getContext(): array
     {
         if (null !== $this->footerText) {
-            return \array_merge([
-                'footer_text' => $this->footerText,
-            ], parent::getContext());
+            return \array_merge(parent::getContext(), ['footer_text' => $this->footerText]);
         }
 
         return parent::getContext();
diff --git a/src/Service/MailService.php b/src/Service/MailService.php
index 173f3a1fe..c8857d18d 100644
--- a/src/Service/MailService.php
+++ b/src/Service/MailService.php
@@ -70,7 +70,7 @@ public function sendNotification(string $fromEmail, User $toUser, string $messag
             ->importance($importance)
             ->subject($this->trans('user.comment.title'))
             ->markdown($this->convert($message))
-            ->setFooterText($this->appNameVersion)
+            ->setFooterText($this->getFooter())
             ->action($this->trans('index.title'), $this->homeUrl);
 
         $this->mailer->send($notification);
@@ -94,4 +94,13 @@ private function convert(string $message): string
 
         return \strip_tags($message);
     }
+
+    private function getFooter(): string
+    {
+        if (null !== $this->translator) {
+            return $this->trans('notification.footer', ['%name%' => $this->appNameVersion]);
+        }
+
+        return $this->appNameVersion;
+    }
 }
diff --git a/src/Twig/FormatExtension.php b/src/Twig/FormatExtension.php
index 6e078b69e..0f4e27de4 100644
--- a/src/Twig/FormatExtension.php
+++ b/src/Twig/FormatExtension.php
@@ -60,6 +60,24 @@ public function booleanFilter(bool $value, ?string $true = null, ?string $false
         return $this->trans('common.value_false');
     }
 
+    /**
+     * {@inheritdoc}
+     */
+    public function getFilters(): array
+    {
+        return [
+            new TwigFilter('identifier', fn (float|int|string|null $number): string => FormatUtils::formatId($number)),
+            new TwigFilter('integer', fn (float|int|string|null $number): string => FormatUtils::formatInt($number)),
+            new TwigFilter('amount', fn (float|int|string|null $number): string => FormatUtils::formatAmount($number)),
+            new TwigFilter('percent', fn (float|int|string|null $number, bool $includeSign = true, int $decimals = 0, int $roundingMode = \NumberFormatter::ROUND_DOWN): string => FormatUtils::formatPercent($number, $includeSign, $decimals, $roundingMode)),
+
+            new TwigFilter('boolean', fn (bool $value, ?string $true = null, ?string $false = null, bool $translate = false): string => $this->booleanFilter($value, $true, $false, $translate)),
+            new TwigFilter('localedate', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->dateFilter($env, $date, $dateFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
+            new TwigFilter('localetime', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->timeFilter($env, $date, $timeFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
+            new TwigFilter('localedatetime', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->dateTimeFilter($env, $date, $dateFormat, $timeFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
+        ];
+    }
+
     /**
      * Formats a date for the current locale; ignoring the time part.
      *
@@ -74,7 +92,7 @@ public function booleanFilter(bool $value, ?string $true = null, ?string $false
      *
      * @throws SyntaxError if the date format or the time format is unknown
      */
-    public function dateFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
+    private function dateFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
     {
         return $this->dateTimeFilter($env, $date, $dateFormat, 'none', $timezone, $calendar, $pattern);
     }
@@ -96,7 +114,7 @@ public function dateFilter(Environment $env, \DateTimeInterface|string|null $dat
      *
      * @throws SyntaxError if the date format or the time format is unknown
      */
-    public function dateTimeFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
+    private function dateTimeFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
     {
         /** @psalm-var array<string, int> $formats */
         static $formats = [
@@ -142,24 +160,6 @@ public function dateTimeFilter(Environment $env, \DateTimeInterface|string|null
         return (string) FormatUtils::formatDateTime($date, $datetype, $timetype, $timezone, $calendar, $pattern);
     }
 
-    /**
-     * {@inheritdoc}
-     */
-    public function getFilters(): array
-    {
-        return [
-            new TwigFilter('identifier', fn (float|int|string|null $number): string => FormatUtils::formatId($number)),
-            new TwigFilter('integer', fn (float|int|string|null $number): string => FormatUtils::formatInt($number)),
-            new TwigFilter('amount', fn (float|int|string|null $number): string => FormatUtils::formatAmount($number)),
-            new TwigFilter('percent', fn (float|int|string|null $number, bool $includeSign = true, int $decimals = 0, int $roundingMode = \NumberFormatter::ROUND_DOWN): string => FormatUtils::formatPercent($number, $includeSign, $decimals, $roundingMode)),
-
-            new TwigFilter('boolean', fn (bool $value, ?string $true = null, ?string $false = null, bool $translate = false): string => $this->booleanFilter($value, $true, $false, $translate)),
-            new TwigFilter('localedate', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->dateFilter($env, $date, $dateFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
-            new TwigFilter('localetime', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->timeFilter($env, $date, $timeFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
-            new TwigFilter('localedatetime', fn (Environment $env, \DateTimeInterface|string|null $date, ?string $dateFormat = null, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string => $this->dateTimeFilter($env, $date, $dateFormat, $timeFormat, $timezone, $calendar, $pattern), ['needs_environment' => true]),
-        ];
-    }
-
     /**
      * Formats a time for the current locale; ignoring the date part.
      *
@@ -174,7 +174,7 @@ public function getFilters(): array
      *
      * @return string the formatted date
      */
-    public function timeFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
+    private function timeFilter(Environment $env, \DateTimeInterface|string|null $date, ?string $timeFormat = null, \DateTimeZone|string|null $timezone = null, ?string $calendar = 'gregorian', ?string $pattern = null): string
     {
         return $this->dateTimeFilter($env, $date, 'none', $timeFormat, $timezone, $calendar, $pattern);
     }
diff --git a/src/Twig/FunctionExtension.php b/src/Twig/FunctionExtension.php
index 80034ca9a..8c7c89d21 100644
--- a/src/Twig/FunctionExtension.php
+++ b/src/Twig/FunctionExtension.php
@@ -67,6 +67,50 @@ public function __construct(KernelInterface $kernel, TranslatorInterface $transl
         $this->version = $this->fileExists($filename) ? (int) \filemtime($filename) : Kernel::VERSION_ID;
     }
 
+    /**
+     * {@inheritdoc}
+     */
+    public function getFilters(): array
+    {
+        return [
+            new TwigFilter('trans_role', fn (RoleInterface|string $role): string => $this->translateRole($role)),
+            new TwigFilter('var_export', fn (mixed $expression): ?string => Utils::exportVar($expression)),
+            new TwigFilter('normalize_whitespace', fn (string $value): string => $this->normalizeWhitespace($value), ['preserves_safety' => ['html']]),
+        ];
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    public function getFunctions(): array
+    {
+        $assetOptions = [
+            'needs_environment' => true,
+            'is_safe' => ['html'],
+        ];
+
+        return [
+            // assets
+            new TwigFunction('asset_exists', fn (?string $path): bool => $this->assetExists($path)),
+            new TwigFunction('file_exists', fn (?string $filename): bool => $this->fileExists($filename)),
+
+            new TwigFunction('asset_if', fn (?string $path = null, ?string $default = null): ?string => $this->assetIf($path, $default)),
+            new TwigFunction('asset_js', fn (Environment $env, string $path, array $parameters = [], ?string $packageName = null): string => $this->getAssetJs($env, $path, $parameters, $packageName), $assetOptions),
+            new TwigFunction('asset_css', fn (Environment $env, string $path, array $parameters = [], ?string $packageName = null): string => $this->getAssetCss($env, $path, $parameters, $packageName), $assetOptions),
+
+            // images
+            new TwigFunction('image_height', fn (string $path): int => $this->getImageHeight($path)),
+            new TwigFunction('image_width', fn (string $path): int => $this->getImageWidth($path)),
+
+            // routes
+            new TwigFunction('cancel_url', fn (Request $request, int $id = 0, string $defaultRoute = AbstractController::HOME_PAGE): string => $this->cancelUrl($request, $id, $defaultRoute)),
+            new TwigFunction('route_params', fn (Request $request, int $id = 0): array => $this->routeParams($request, $id)),
+
+            // php
+            new TwigFunction('is_int', 'is_int'),
+        ];
+    }
+
     /**
      * Checks if the given asset path exists.
      *
@@ -74,7 +118,7 @@ public function __construct(KernelInterface $kernel, TranslatorInterface $transl
      *
      * @return bool true if exists
      */
-    public function assetExists(?string $path): bool
+    private function assetExists(?string $path): bool
     {
         // path?
         if (empty($path)) {
@@ -108,7 +152,7 @@ public function assetExists(?string $path): bool
      *
      * @return string|null the path, if existing, the default path otherwise
      */
-    public function assetIf(?string $path = null, ?string $default = null): ?string
+    private function assetIf(?string $path = null, ?string $default = null): ?string
     {
         if ($this->assetExists($path)) {
             return $path;
@@ -129,7 +173,7 @@ public function assetIf(?string $path = null, ?string $default = null): ?string
      *
      * @return string the cancel URL
      */
-    public function cancelUrl(Request $request, int $id = 0, string $defaultRoute = AbstractController::HOME_PAGE): string
+    private function cancelUrl(Request $request, int $id = 0, string $defaultRoute = AbstractController::HOME_PAGE): string
     {
         return $this->generator->cancelUrl($request, $id, $defaultRoute);
     }
@@ -141,24 +185,22 @@ public function cancelUrl(Request $request, int $id = 0, string $defaultRoute =
      *
      * @return bool true if the file or directory exists, false otherwise
      */
-    public function fileExists(?string $filename): bool
+    private function fileExists(?string $filename): bool
     {
-        return $filename && FileUtils::exists($filename);
+        return null !== $filename && FileUtils::exists($filename);
     }
 
     /**
      * Output a link style sheet tag with a nonce value.
      */
-    public function getAssetCss(Environment $env, string $path, array $parameters = [], ?string $packageName = null): string
+    private function getAssetCss(Environment $env, string $path, array $parameters = [], ?string $packageName = null): string
     {
         $url = $this->getAssetUrl($env, $path, $packageName);
-
-        // merge and reduce parameters
-        $parameters += [
+        $parameters = \array_merge([
             'rel' => 'stylesheet',
-            'nonce' => $this->getNonce($env),
             'href' => \sprintf('%s?%d', $url, $this->version),
-        ];
+            'nonce' => $this->getNonce($env),
+        ], $parameters);
         $attributes = $this->reduceParameters($parameters);
 
         return "<link$attributes>";
@@ -167,62 +209,47 @@ public function getAssetCss(Environment $env, string $path, array $parameters =
     /**
      * Output a java script source tag with a nonce value.
      */
-    public function getAssetJs(Environment $env, string $path, array $parameters = [], ?string $packageName = null): string
+    private function getAssetJs(Environment $env, string $path, array $parameters = [], ?string $packageName = null): string
     {
         $url = $this->getAssetUrl($env, $path, $packageName);
-
-        // merge and reduce parameters
-        $parameters += [
-            'nonce' => $this->getNonce($env),
+        $parameters = \array_merge([
             'src' => \sprintf('%s?%d', $url, $this->version),
-        ];
+            'nonce' => $this->getNonce($env),
+        ], $parameters);
         $attributes = $this->reduceParameters($parameters);
 
         return "<script$attributes></script>";
     }
 
     /**
-     * {@inheritdoc}
+     * Returns the public url/path of an asset.
+     *
+     * If the package used to generate the path is an instance of
+     * UrlPackage, you will always get a URL and not a path.
+     *
+     * @param Environment $env         the Twig environnement
+     * @param string      $path        a public path
+     * @param string|null $packageName the optional name of the asset package to use
+     *
+     * @return string the public path of the asset
      */
-    public function getFilters(): array
+    private function getAssetUrl(Environment $env, string $path, ?string $packageName = null): string
     {
-        return [
-            new TwigFilter('trans_role', fn (RoleInterface|string $role): string => $this->translateRole($role)),
-            new TwigFilter('var_export', fn (mixed $expression): ?string => Utils::exportVar($expression)),
-            new TwigFilter('normalize_whitespace', fn (string $value): string => $this->normalizeWhitespace($value), ['preserves_safety' => ['html']]),
-        ];
+        if (null === $this->asset) {
+            $this->asset = $this->getExtension($env, AssetExtension::class);
+        }
+
+        return $this->asset->getAssetUrl($path, $packageName);
     }
 
     /**
-     * {@inheritdoc}
+     * @template T of \Twig\Extension\ExtensionInterface
+     * @psalm-param class-string<T> $className
+     * @psalm-return T
      */
-    public function getFunctions(): array
+    private function getExtension(Environment $env, string $className)
     {
-        $assetOptions = [
-            'needs_environment' => true,
-            'is_safe' => ['html'],
-        ];
-
-        return [
-            // assets
-            new TwigFunction('asset_exists', fn (?string $path): bool => $this->assetExists($path)),
-            new TwigFunction('file_exists', fn (?string $filename): bool => $this->fileExists($filename)),
-
-            new TwigFunction('asset_if', fn (?string $path = null, ?string $default = null): ?string => $this->assetIf($path, $default)),
-            new TwigFunction('asset_js', fn (Environment $env, string $path, array $parameters = [], ?string $packageName = null): string => $this->getAssetJs($env, $path, $parameters, $packageName), $assetOptions),
-            new TwigFunction('asset_css', fn (Environment $env, string $path, array $parameters = [], ?string $packageName = null): string => $this->getAssetCss($env, $path, $parameters, $packageName), $assetOptions),
-
-            // images
-            new TwigFunction('image_height', fn (string $path): int => $this->getImageHeight($path)),
-            new TwigFunction('image_width', fn (string $path): int => $this->getImageWidth($path)),
-
-            // routes
-            new TwigFunction('cancel_url', fn (Request $request, int $id = 0, string $defaultRoute = AbstractController::HOME_PAGE): string => $this->cancelUrl($request, $id, $defaultRoute)),
-            new TwigFunction('route_params', fn (Request $request, int $id = 0): array => $this->routeParams($request, $id)),
-
-            // php
-            new TwigFunction('is_int', 'is_int'),
-        ];
+        return $env->getExtension($className);
     }
 
     /**
@@ -230,7 +257,7 @@ public function getFunctions(): array
      *
      * @param string $path an existing image path relative to the public directory
      */
-    public function getImageHeight(string $path): int
+    private function getImageHeight(string $path): int
     {
         $fullPath = (string) \realpath($this->webDir . $path);
         $size = (array) \getimagesize($fullPath);
@@ -243,7 +270,7 @@ public function getImageHeight(string $path): int
      *
      * @param string $path an existing image path relative to the public directory
      */
-    public function getImageWidth(string $path): int
+    private function getImageWidth(string $path): int
     {
         $fullPath = (string) \realpath($this->webDir . $path);
         $size = (array) \getimagesize($fullPath);
@@ -251,6 +278,21 @@ public function getImageWidth(string $path): int
         return (int) $size[0];
     }
 
+    /**
+     * Generates a random nonce parameter.
+     *
+     * @param Environment $env the Twig environnement
+     */
+    private function getNonce(Environment $env): string
+    {
+        if (null === $this->nonce) {
+            $extension = $this->getExtension($env, NonceExtension::class);
+            $this->nonce = $extension->getNonce();
+        }
+
+        return $this->nonce;
+    }
+
     /**
      * This filter replaces duplicated spaces and/or linebreaks with single space.
      *
@@ -260,7 +302,7 @@ public function getImageWidth(string $path): int
      *
      * @return string the cleaned value
      */
-    public function normalizeWhitespace(string $value): string
+    private function normalizeWhitespace(string $value): string
     {
         // attributes
         $value = (string) \preg_replace('/\s+=\s+/u', '=', $value);
@@ -271,63 +313,6 @@ public function normalizeWhitespace(string $value): string
         return \trim($value);
     }
 
-    /**
-     * Gets the route parameters.
-     *
-     * @param Request $request the request
-     * @param int     $id      the entity identifier
-     */
-    public function routeParams(Request $request, int $id = 0): array
-    {
-        return $this->generator->routeParams($request, $id);
-    }
-
-    /**
-     * Returns the public url/path of an asset.
-     *
-     * If the package used to generate the path is an instance of
-     * UrlPackage, you will always get a URL and not a path.
-     *
-     * @param Environment $env         the Twig environnement
-     * @param string      $path        a public path
-     * @param string|null $packageName the optional name of the asset package to use
-     *
-     * @return string the public path of the asset
-     */
-    private function getAssetUrl(Environment $env, string $path, ?string $packageName = null): string
-    {
-        if (null === $this->asset) {
-            $this->asset = $this->getExtension($env, AssetExtension::class);
-        }
-
-        return $this->asset->getAssetUrl($path, $packageName);
-    }
-
-    /**
-     * @template T of \Twig\Extension\ExtensionInterface
-     * @psalm-param class-string<T> $className
-     * @psalm-return T
-     */
-    private function getExtension(Environment $env, string $className)
-    {
-        return $env->getExtension($className);
-    }
-
-    /**
-     * Generates a random nonce parameter.
-     *
-     * @param Environment $env the Twig environnement
-     */
-    private function getNonce(Environment $env): string
-    {
-        if (null === $this->nonce) {
-            $extension = $this->getExtension($env, NonceExtension::class);
-            $this->nonce = $extension->getNonce();
-        }
-
-        return $this->nonce;
-    }
-
     /**
      * Reduce parameters with a key/value tags.
      */
@@ -341,4 +326,15 @@ private function reduceParameters(array $parameters): string
 
         return '';
     }
+
+    /**
+     * Gets the route parameters.
+     *
+     * @param Request $request the request
+     * @param int     $id      the entity identifier
+     */
+    private function routeParams(Request $request, int $id = 0): array
+    {
+        return $this->generator->routeParams($request, $id);
+    }
 }
diff --git a/src/Twig/ThemesExtension.php b/src/Twig/ThemesExtension.php
index 1fd31ed16..b353ae5ee 100644
--- a/src/Twig/ThemesExtension.php
+++ b/src/Twig/ThemesExtension.php
@@ -47,12 +47,24 @@ public function getFunctions(): array
         ];
     }
 
+    /**
+     * Gets the current theme.
+     *
+     * @param Request|null $request the request
+     *
+     * @return Theme the current theme, if any; the default theme otherwise
+     */
+    private function getCurrentTheme(?Request $request = null): Theme
+    {
+        return $this->service->getCurrentTheme($request);
+    }
+
     /**
      * Gets the theme background.
      *
      * @param Request $request the request
      */
-    public function getThemeBackground(Request $request): string
+    private function getThemeBackground(Request $request): string
     {
         // get background
         $background = $this->service->getThemeBackground($request);
@@ -74,7 +86,7 @@ public function getThemeBackground(Request $request): string
      *
      * @param Request $request the request
      */
-    public function getThemeCss(Request $request): string
+    private function getThemeCss(Request $request): string
     {
         // get CSS
         $theme = $this->getCurrentTheme($request);
@@ -90,7 +102,7 @@ public function getThemeCss(Request $request): string
      *
      * @param Request $request the request
      */
-    public function getThemeName(Request $request): string
+    private function getThemeName(Request $request): string
     {
         return $this->getCurrentTheme($request)->getName();
     }
@@ -100,7 +112,7 @@ public function getThemeName(Request $request): string
      *
      * @param Request $request the request
      */
-    public function isDarkTheme(Request $request): bool
+    private function isDarkTheme(Request $request): bool
     {
         return $this->service->isDarkTheme($request);
     }
@@ -110,20 +122,8 @@ public function isDarkTheme(Request $request): bool
      *
      * @param Request $request the request
      */
-    public function isDefaultTheme(Request $request): bool
+    private function isDefaultTheme(Request $request): bool
     {
         return $this->getCurrentTheme($request)->isDefault();
     }
-
-    /**
-     * Gets the current theme.
-     *
-     * @param Request|null $request the request
-     *
-     * @return Theme the current theme, if any; the default theme otherwise
-     */
-    private function getCurrentTheme(?Request $request = null): Theme
-    {
-        return $this->service->getCurrentTheme($request);
-    }
 }
diff --git a/templates/about/about.html.twig b/templates/about/about.html.twig
index 0863d4d5e..8ca205f0f 100644
--- a/templates/about/about.html.twig
+++ b/templates/about/about.html.twig
@@ -58,10 +58,10 @@
 {% endblock %}
 
 {% block javascripts %}
-{% if app.debug %}
+{%- if app.debug -%}
 {{ parent() }}
 {{ asset_js('js/application/about.js') }}
-{% else %}
+{%- else -%}
 {{ asset_js('js/about.js') }}
-{% endif %}
+{%- endif -%}
 {% endblock %}
diff --git a/templates/base.html.twig b/templates/base.html.twig
index 4c6764ebc..13852bad0 100644
--- a/templates/base.html.twig
+++ b/templates/base.html.twig
@@ -36,14 +36,13 @@
 <link rel="apple-touch-icon" sizes="180x180" href="{{ asset('images/icons/apple-icon-180x180.png') }}">
 {# stylesheets #}
 {{ asset_css(theme_css(app.request), {'title': theme_name(app.request)}) }}
-{% block stylesheets -%}
+{% block stylesheets %}
 {{ asset_css('css/style.css') }}
 {% endblock %}
-{#  {{ asset_js('js/vendor/iconify/iconify.js') }} #}
 </head>
 <body>
 {# navigation #}
-{% block navigation -%}{%- include 'navigation/navigation.html.twig' %}{%- endblock %}
+{%- block navigation -%}{%- include 'navigation/navigation.html.twig' %}{%- endblock %}
 {# container #}
 <div role="main" class="{% block container_class 'container' %}">
     {% block body -%}{%- endblock %}
@@ -55,7 +54,7 @@
 {# footer #}
 {% block footer -%}{% include 'footer.html.twig' %}{%- endblock %}
 {# java scripts #}
-<noscript>{{ 'common.no_script_support'|trans }}</noscript>
+{# java scripts #}
 {% block javascripts %}
 {% if app.debug %}
 {{ asset_js('js/vendor/jquery/jquery.js') }}
@@ -70,5 +69,6 @@
 {{ asset_js('js/core_common.js') }}
 {% endif %}
 {% endblock %}
+<noscript>{{ 'common.no_script_support'|trans }}</noscript>
 </body>
 </html>
diff --git a/templates/calculation/calculation_edit.html.twig b/templates/calculation/calculation_edit.html.twig
index d284a9e73..291b8d759 100644
--- a/templates/calculation/calculation_edit.html.twig
+++ b/templates/calculation/calculation_edit.html.twig
@@ -1,6 +1,5 @@
 {% extends 'base.html.twig' %}
 {% form_theme form _self %}
-
 {# customize the user margin field to display a tooltip #}
 {% block _calculation_userMargin_widget -%}
     {%- set type = type|default('number') -%}
@@ -20,7 +19,6 @@
         </div>
     </div>
 {%- endblock %}
-
 {# parameters #}
 {%- set title = new ? 'calculation.add.title' : 'calculation.edit.title' -%}
 {%- set title_parameters = new ? {} : {'%id%': item.id|identifier} -%}
@@ -40,7 +38,6 @@
         'data-error-margin': 'calculation.edit.error.user_margin'|trans,
         'data-item-empty': 'calculation.edit.empty_items'|trans}) -%}
 {%- endif -%}
-
 {# cancel path #}
 {%- set list_path = 'calculation_table' -%}
 {%- set cancel_path = cancel_url(app.request, item.id|default(0), list_path) -%}
@@ -65,16 +62,15 @@
     {%- include 'dialog/edit_item_dialog.html.twig' with {'form': item_dialog} only %}
     {%- include 'dialog/edit_task_dialog.html.twig' with {'form': task_dialog, 'tasks': tasks} only %}
 {%- endif %}
-
 {%- endblock %}
 
 {% block stylesheets %}
 {{ asset_css('css/calculation.css') }}
-{%- endblock -%}
+{% endblock %}
 
 {% block javascripts %}
 {% if app.debug %}
-{{ parent() }}
+{{ parent() -}}
 {{ asset_js('js/application/calculation_error.js') }}
 {% if editable %}
 {{ asset_js('js/vendor/jquery-validate/jquery.validate.js') }}
diff --git a/templates/calculation/calculation_edit_panel_totals.html.twig b/templates/calculation/calculation_edit_panel_totals.html.twig
index 48ec7dd95..3a298ed10 100644
--- a/templates/calculation/calculation_edit_panel_totals.html.twig
+++ b/templates/calculation/calculation_edit_panel_totals.html.twig
@@ -6,7 +6,7 @@
         <h1 class="card-title">{{ icons.icon('list-ul', 'calculation.edit.panel_resume') }}</h1>
     </div>
     <div class="card-body py-1 px-2">
-        <div class="table-responsive-sm">
+        <div class="table-responsive">
             <table id="totals-table" class="table table-overview table-sm">
                 <tbody>
                     {% include 'calculation/calculation_ajax_totals.html.twig' %}
diff --git a/templates/cards/card_edit.html.twig b/templates/cards/card_edit.html.twig
index 7af5fef07..37983600c 100644
--- a/templates/cards/card_edit.html.twig
+++ b/templates/cards/card_edit.html.twig
@@ -55,7 +55,7 @@
 
 {% block javascripts -%}
 {% if app.debug %}
-{{ parent() }}
+{{ parent() -}}
 {{ asset_js('js/vendor/jquery-validate/jquery.validate.js') }}
 {{ asset_js('js/vendor/jquery-validate/additional-methods.js') }}
 {{ asset_js('js/vendor/jquery-validate/localization/messages_fr.js') }}
diff --git a/templates/cards/card_table.html.twig b/templates/cards/card_table.html.twig
index 3538846d4..c3d5c2e16 100644
--- a/templates/cards/card_table.html.twig
+++ b/templates/cards/card_table.html.twig
@@ -265,7 +265,7 @@
 
 {% block javascripts -%}
 {% if app.debug %}
-{{ parent() }}
+{{ parent() -}}
 {{ asset_js('js/vendor/jquery-mark/jquery.mark.js') }}
 {{ asset_js('js/vendor/bootstrap-table/bootstrap-table.js') }}
 {{ asset_js('js/vendor/bootstrap-table/bootstrap-table-defer-url.js') }}
diff --git a/templates/chart/chart_base.html.twig b/templates/chart/chart_base.html.twig
index f02677b9c..011c5b2ab 100644
--- a/templates/chart/chart_base.html.twig
+++ b/templates/chart/chart_base.html.twig
@@ -22,10 +22,12 @@
 <div class="row" id="data">
 {% block data %}{% endblock %}
 </div>
+
 {% endblock %}
 
 {% block card_footer -%}
 {{ icons.homepage() }}
+
 {%- endblock %}
 
 {% block stylesheets %}
@@ -34,12 +36,15 @@
 
 {% block javascripts %}
 {% if app.debug %}
-{{ parent() }}
+{{ parent() -}}
 {{ asset_js('js/vendor/highcharts/highcharts.js') }}
+{{ asset_js('js/vendor/highcharts/accessibility.js') }}
 {{ asset_js('js/plugins/plugin-rowlink.js') }}
 {{ asset_js('js/application/chart.js') }}
 {% else %}
 {{ asset_js('js/chart.js') }}
 {% endif %}
-<script nonce="{{ csp_nonce() }}">{{ chart(chart) }}</script>
+<script nonce="{{ csp_nonce() }}">
+    {{ chart(chart) }}
+</script>
 {% endblock %}
diff --git a/templates/emails/csp_violation.html.twig b/templates/emails/csp_violation.html.twig
new file mode 100644
index 000000000..552000974
--- /dev/null
+++ b/templates/emails/csp_violation.html.twig
@@ -0,0 +1,37 @@
+{% extends 'emails/notification.html.twig' %}
+
+{% macro output_policy(value) -%}
+{% for key, entries in value %}
+    <tr>
+        <td>{{ key }}</td>
+        <td>{{ entries|nl2br }}</td>
+    </tr>
+{%- endfor %}
+{% endmacro %}
+
+{% block content %}
+<container>
+    <row>
+        <columns>
+            {{ 'notification.csp_description'|trans({'%name%': app_name}) }}
+        </columns>
+    </row>
+</container>
+<container>
+    <table id="csp">
+        {% for key, value in context %}
+            {% if 'original-policy' == key %}
+                <tr>
+                    <td colspan="2"><u>{{ key }}</u></td>
+                </tr>
+                {{ _self.output_policy(value) }}
+            {% else %}
+                <tr>
+                    <td><u>{{ key }}</u></td>
+                    <td>{{- value -}}</td>
+                </tr>
+            {% endif %}
+        {% endfor %}
+    </table>
+</container>
+{% endblock %}
diff --git a/templates/emails/notification.html.twig b/templates/emails/notification.html.twig
index ffecce9aa..0baa95a8b 100644
--- a/templates/emails/notification.html.twig
+++ b/templates/emails/notification.html.twig
@@ -6,15 +6,24 @@
 {% endblock %}
 
 {% block lead %}
-    {% if importance is not null %}<small><strong>{{ ('importance.full.' ~ importance)|trans }}</strong></small>{% endif %}
-    <p class="lead">
-        {{ email.subject }}
-    </p>
+<container>
+    <row>
+        <columns large="1" small="2" valign="middle">
+            <img src="{{ email.image('@images/icons/android-icon-36x36.png') }}" alt="{{ app_description }}">
+        </columns>
+        <columns large="11" small="10" valign="middle">
+            {% if importance is not null %}<small><strong>{{ ('importance.full.' ~ importance)|trans }}</strong></small>{% endif %}
+            <p class="lead">
+                {{- email.subject -}}
+            </p>
+        </columns>
+    </row>
+</container>
 {% endblock %}
 
 {% block exception %}
-    {% if exception %}
-        <spacer size="16"></spacer>
-        <p><em>La trace de la pile d'exception est en pièce jointe.</em></p>
-    {% endif %}
+{% if exception %}
+    <spacer size="16"></spacer>
+    <p><em>{{ 'notification.exception'|trans }}</em></p>
+{% endif %}
 {% endblock %}
diff --git a/templates/index/index.html.twig b/templates/index/index.html.twig
index 404e4aeec..2027deaec 100644
--- a/templates/index/index.html.twig
+++ b/templates/index/index.html.twig
@@ -43,19 +43,19 @@
 
 {% block stylesheets %}
 {{ asset_css(enabled ? 'css/calculation.css' : 'css/center.css') }}
-{%- endblock -%}
+{% endblock %}
 
 {% block javascripts %}
 {% if enabled %}
-    {% if app.debug %}
-        {{ parent() }}
-        {{- asset_js('js/vendor/contextmenu/jquery.contextMenu.js') }}
-        {{ asset_js('js/plugins/plugin-rowlink.js') }}
-        {{ asset_js('js/extensions/contextmenu-extensions.js') }}
-        {{ asset_js('js/application/index.js') }}
-    {% else %}
-        {{- asset_js('js/index.js') }}
-    {% endif %}
-    {% include 'cookie_banner.html.twig' %}
+{% if app.debug %}
+{{ parent() -}}
+{{ asset_js('js/vendor/contextmenu/jquery.contextMenu.js') }}
+{{ asset_js('js/plugins/plugin-rowlink.js') }}
+{{ asset_js('js/extensions/contextmenu-extensions.js') }}
+{{ asset_js('js/application/index.js') }}
+{% else %}
+{{ asset_js('js/index.js') }}
+{% endif %}
+{% include 'cookie_banner.html.twig' %}
 {% endif %}
 {% endblock %}
diff --git a/templates/macros/_attributes.html.twig b/templates/macros/_attributes.html.twig
index 96e811067..c4a6c559b 100644
--- a/templates/macros/_attributes.html.twig
+++ b/templates/macros/_attributes.html.twig
@@ -1,4 +1,4 @@
 {# output attributes #}
 {% macro attribs(attributes, prefix='') -%}
-{% for attrname, attrvalue in attributes %} {{ prefix }}{{ attrname }}="{{ attrvalue }}"{% endfor %}
+{% for name, value in attributes %} {{ prefix }}{{ name }}="{{ value }}"{% endfor %}
 {%- endmacro %}
diff --git a/templates/navigation/navigation.html.twig b/templates/navigation/navigation.html.twig
index 07f1ea423..c2abb0f75 100644
--- a/templates/navigation/navigation.html.twig
+++ b/templates/navigation/navigation.html.twig
@@ -1,8 +1,6 @@
 {# Navigation toolbar #}
-
 {# imports #}
 {% import 'macros/_icons.html.twig' as icons %}
-
 {# parameters #}
 {%- set is_env_dev = app_mode == 'dev' -%}
 {%- set is_env_prod = app_mode == 'prod' -%}
@@ -13,7 +11,6 @@
 {%- set is_previous_admin = is_granted('IS_IMPERSONATOR') -%}
 {%- set is_remembered = is_granted('IS_AUTHENTICATED_REMEMBERED') -%}
 {%- set is_test = is_dev and is_remembered and app.user.userIdentifier == 'Bibi' -%}
-
 {# rights #}
 {%- set is_granted_calculation = is_granted(ATTRIBUTE_LIST, ENTITY_CALCULATION) -%}
 {%- set is_granted_product = is_granted(ATTRIBUTE_LIST, ENTITY_PRODUCT) -%}
@@ -23,7 +20,6 @@
 {%- set is_granted_calculation_state = is_granted(ATTRIBUTE_LIST, ENTITY_CALCULATION_STATE) -%}
 {%- set is_granted_global_margin = is_granted(ATTRIBUTE_LIST, ENTITY_GLOBAL_MARGIN) -%}
 {%- set is_granted_customer = is_granted(ATTRIBUTE_LIST, ENTITY_CUSTOMER) and is_dev -%}
-
 {# navigation #}
 <nav id="navigation" class="navbar navbar-expand-md {{ theme_background(app.request) }}">
     <a class="navbar-brand" href="{{ path('homepage') }}" title="{{ 'index.title_help'|trans }}">
@@ -34,10 +30,10 @@
     </button>
     <div class="collapse navbar-collapse" id="navbarContent">
         <ul class="navbar-nav mr-auto">
-            {%- if is_granted_calculation -%}
-                {{- icons.navItem(path('calculation_table'), 'calculation.list.title', ICON_CALCULATION) -}}
-            {%- endif -%}
-            {% include 'navigation/navigation_data.html.twig' %}
+            {% if is_granted_calculation -%}
+                {{ icons.navItem(path('calculation_table'), 'calculation.list.title', ICON_CALCULATION) }}
+            {% endif %}
+            {%- include 'navigation/navigation_data.html.twig' %}
             {% include 'navigation/navigation_tools.html.twig' %}
             {% include 'navigation/navigation_chart.html.twig' %}
             {% include 'navigation/navigation_test.html.twig' %}
diff --git a/templates/navigation/navigation_chart.html.twig b/templates/navigation/navigation_chart.html.twig
index 93fd6be8a..a49254233 100644
--- a/templates/navigation/navigation_chart.html.twig
+++ b/templates/navigation/navigation_chart.html.twig
@@ -1,17 +1,17 @@
 {# chart menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-{%- if is_granted_calculation -%}
-<li class="nav-item dropdown">
-    <a class="nav-link dropdown-toggle" href="#" id="chartDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-        {{- icons.icon('chart-area', 'menu_graphics', 'chart') -}}
-    </a>
-    <div class="dropdown-menu" aria-labelledby="chartDropdown">
-        {{- icons.dropdownItem(path('chart_by_month'), 'title_by_month', 'calendar-alt far', 'chart') -}}
-        {{- icons.dropdownItem(path('chart_by_state'), 'title_by_state', ICON_CALCULATION_STATE, 'chart') -}}
-        {% if is_test -%}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('calculation_pivot'), 'pivot.title', 'table') -}}
-        {% endif -%}
-    </div>
-</li>
-{% endif -%}
+{% if is_granted_calculation %}
+    <li class="nav-item dropdown">
+        <a class="nav-link dropdown-toggle" href="#" id="chartDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            {{ icons.icon('chart-area', 'menu_graphics', 'chart') }}
+        </a>
+        <div class="dropdown-menu" aria-labelledby="chartDropdown">
+            {{ icons.dropdownItem(path('chart_by_month'), 'title_by_month', 'calendar-alt far', 'chart') }}
+            {{ icons.dropdownItem(path('chart_by_state'), 'title_by_state', ICON_CALCULATION_STATE, 'chart') }}
+            {% if is_test %}
+                {{ icons.dropdownSeparator }}
+                {{ icons.dropdownItem(path('calculation_pivot'), 'pivot.title', 'table') }}
+            {% endif %}
+        </div>
+    </li>
+{% endif %}
diff --git a/templates/navigation/navigation_data.html.twig b/templates/navigation/navigation_data.html.twig
index d08fc0031..6aa05710c 100644
--- a/templates/navigation/navigation_data.html.twig
+++ b/templates/navigation/navigation_data.html.twig
@@ -1,34 +1,36 @@
 {# data menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-{%- set is_granted_data = is_granted_product or is_granted_category or is_granted_group or is_granted_calculation_state or is_granted_global_margin or is_granted_task or is_granted_customer -%}
-{%- if is_granted_data -%}
-<li class="nav-item dropdown">
-    <a class="nav-link dropdown-toggle" href="#" id="dataDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-        {{- icons.icon('database', 'index.menu_data') -}}
-    </a>
-    <div class="dropdown-menu" aria-labelledby="dataDropdown">
-    {%- if is_granted_product -%}
-        {{- icons.dropdownItem(path('product_table'), 'product.list.title', ICON_PRODUCT) -}}
-    {%- endif -%}
-    {%- if is_granted_task -%}
-        {{- icons.dropdownItem(path('task_table'), 'task.list.title', ICON_TASK) -}}
-    {%- endif -%}
-    {%- if is_granted_category -%}
-        {{- icons.dropdownItem(path('category_table'), 'category.list.title', ICON_CATEGORY) -}}
-    {%- endif -%}
-    {%- if is_granted_group -%}
-        {{- icons.dropdownItem(path('group_table'), 'group.list.title', ICON_GROUP) -}}
-    {%- endif -%}
-    {%- if is_granted_calculation_state -%}
-        {{- icons.dropdownItem(path('calculationstate_table'), 'calculationstate.list.title', ICON_CALCULATION_STATE) -}}
-    {%- endif -%}
-    {%- if is_granted_global_margin -%}
-        {{- icons.dropdownItem(path('globalmargin_table'), 'globalmargin.list.title', ICON_GLOBAL_MARGIN) -}}
-    {%- endif -%}
-    {%- if is_granted_customer %}
-        {%- if is_granted_data -%}{{- icons.dropdownSeparator -}}{% endif %}
-        {{- icons.dropdownItem(path('customer_table'), 'customer.list.title', ICON_CUSTOMER) -}}
-    {%- endif -%}
-    </div>
-</li>
+{% set is_granted_data = is_granted_product or is_granted_category or is_granted_group or is_granted_calculation_state or is_granted_global_margin or is_granted_task or is_granted_customer %}
+{% if is_granted_data -%}
+    <li class="nav-item dropdown">
+        <a class="nav-link dropdown-toggle" href="#" id="dataDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+            {{ icons.icon('database', 'index.menu_data') }}
+        </a>
+        <div class="dropdown-menu" aria-labelledby="dataDropdown">
+            {% if is_granted_product -%}
+                {{ icons.dropdownItem(path('product_table'), 'product.list.title', ICON_PRODUCT) }}
+            {% endif -%}
+            {% if is_granted_task -%}
+                {{ icons.dropdownItem(path('task_table'), 'task.list.title', ICON_TASK) }}
+            {% endif -%}
+            {% if is_granted_category -%}
+                {{ icons.dropdownItem(path('category_table'), 'category.list.title', ICON_CATEGORY) }}
+            {% endif -%}
+            {% if is_granted_group -%}
+                {{ icons.dropdownItem(path('group_table'), 'group.list.title', ICON_GROUP) }}
+            {% endif -%}
+            {% if is_granted_calculation_state -%}
+                {{ icons.dropdownItem(path('calculationstate_table'), 'calculationstate.list.title', ICON_CALCULATION_STATE) }}
+            {% endif -%}
+            {% if is_granted_global_margin -%}
+                {{ icons.dropdownItem(path('globalmargin_table'), 'globalmargin.list.title', ICON_GLOBAL_MARGIN) }}
+            {% endif -%}
+            {% if is_granted_customer %}
+                {%- if is_granted_data -%}
+                    {{ icons.dropdownSeparator }}
+                {% endif -%}
+                {{ icons.dropdownItem(path('customer_table'), 'customer.list.title', ICON_CUSTOMER) }}
+            {% endif %}
+        </div>
+    </li>
 {% endif %}
diff --git a/templates/navigation/navigation_search.html.twig b/templates/navigation/navigation_search.html.twig
index 097243142..6903661f7 100644
--- a/templates/navigation/navigation_search.html.twig
+++ b/templates/navigation/navigation_search.html.twig
@@ -1,6 +1,5 @@
 {# search menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-
 {% if show_navigation ?? false -%}
 <li class="nav-item mx-2 my-auto">
     <a href="#" id="navigation-search-button" class="nav-link" title="{{ 'search.title'|trans }}">
diff --git a/templates/navigation/navigation_test.html.twig b/templates/navigation/navigation_test.html.twig
index 63a09e99a..4fb96ccbd 100644
--- a/templates/navigation/navigation_test.html.twig
+++ b/templates/navigation/navigation_test.html.twig
@@ -1,32 +1,31 @@
 {# test menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-
 {% if is_test -%}
 <li class="nav-item dropdown">
     <a class="nav-link dropdown-toggle" href="#" id="testDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-        {{- icons.icon('bug', 'index.menu_test') -}}
+        {{ icons.icon('bug', 'index.menu_test') }}
     </a>
     <div class="dropdown-menu" aria-labelledby="testDropdown">
-        {{- icons.dropdownItem(path('test_notifications'), 'test.notification', 'bell far') -}}
-        {{- icons.dropdownItem(path('test_editor'), 'test.editor', 'edit') -}}
-        {{- icons.dropdownItem(path('calendar_year'), 'calendar.year_title', 'calendar-alt far', null, {'%year%': 'now'|date('Y')}) -}}
-        {{- icons.dropdownItem(path('test_timeline'), 'timeline.title', 'stream') -}}
-        {{- icons.dropdownItem(path('test_recaptcha'), 'test.recaptcha', 'google fab') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('exchange_display'), 'exchangerate.title', 'comments-dollar') -}}
-        {{- icons.dropdownItem(path('openweather_weather'), 'openweather.current.title', 'cloud-sun') -}}
-        {{- icons.dropdownItem(path('test_translate'), 'translator.title', 'globe') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItemExternal(path('test_html'), 'test.html', 'code') -}}
-        {{- icons.dropdownItem(path('test_password'), 'password.title', 'lock') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('admin_import'), 'swisspost.title', 'download') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('generate'), 'generate.title', 'random') -}}
-        {{- icons.dropdownItem(path('update'), 'update.title', 'edit') -}}
-        {{- icons.dropdownItem(path('schema'), 'schema.index.title', 'table') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('help'), 'help.title', 'question-circle') -}}
+        {{ icons.dropdownItem(path('test_notifications'), 'test.notification', 'bell far') }}
+        {{ icons.dropdownItem(path('test_editor'), 'test.editor', 'edit') }}
+        {{ icons.dropdownItem(path('calendar_year'), 'calendar.year_title', 'calendar-alt far', null, {'%year%': 'now'|date('Y')}) }}
+        {{ icons.dropdownItem(path('test_timeline'), 'timeline.title', 'stream') }}
+        {{ icons.dropdownItem(path('test_recaptcha'), 'test.recaptcha', 'google fab') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('exchange_display'), 'exchangerate.title', 'comments-dollar') }}
+        {{ icons.dropdownItem(path('openweather_weather'), 'openweather.current.title', 'cloud-sun') }}
+        {{ icons.dropdownItem(path('test_translate'), 'translator.title', 'globe') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItemExternal(path('test_html'), 'test.html', 'code') }}
+        {{ icons.dropdownItem(path('test_password'), 'password.title', 'lock') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('admin_import'), 'swisspost.title', 'download') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('generate'), 'generate.title', 'random') }}
+        {{ icons.dropdownItem(path('update'), 'update.title', 'edit') }}
+        {{ icons.dropdownItem(path('schema'), 'schema.index.title', 'table') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('help'), 'help.title', 'question-circle') }}
     </div>
 </li>
 {% endif -%}
diff --git a/templates/navigation/navigation_tools.html.twig b/templates/navigation/navigation_tools.html.twig
index 9d5385f90..34b2e7284 100644
--- a/templates/navigation/navigation_tools.html.twig
+++ b/templates/navigation/navigation_tools.html.twig
@@ -1,23 +1,22 @@
 {# tool menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-
 <li class="nav-item dropdown">
     <a class="nav-link dropdown-toggle" href="#" id="toolsDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-        {{- icons.icon('tools', 'index.menu_tools') -}}
+        {{ icons.icon('tools', 'index.menu_tools') }}
     </a>
     <div class="dropdown-menu" aria-labelledby="toolsDropdown">
-        {{- icons.dropdownItem(path('search'), 'search.title', 'search') -}}
+        {{ icons.dropdownItem(path('search'), 'search.title', 'search') }}
         {% if is_admin %}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('admin_product'), 'product.update.title', ICON_PRODUCT) -}}
-        {{- icons.dropdownItem(path('admin_archive'), 'archive.title', 'calendar-xmark far') -}}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('below_table'), 'below.title', ICON_GLOBAL_MARGIN) -}}
-        {{- icons.dropdownItem(path('duplicate_table'), 'duplicate.title', 'copy far') -}}
-        {{- icons.dropdownItem(path('empty_table'), 'empty.title', 'file-code far') -}}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('admin_product'), 'product.update.title', ICON_PRODUCT) }}
+        {{ icons.dropdownItem(path('admin_archive'), 'archive.title', 'calendar-xmark far') }}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('below_table'), 'below.title', ICON_GLOBAL_MARGIN) }}
+        {{ icons.dropdownItem(path('duplicate_table'), 'duplicate.title', 'copy far') }}
+        {{ icons.dropdownItem(path('empty_table'), 'empty.title', 'file-code far') }}
         {%- if is_granted_task -%}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('task_compute', {'caller': path('homepage'), 'id': 0}), 'taskcompute.title', 'keyboard') -}}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('task_compute', {'caller': path('homepage'), 'id': 0}), 'taskcompute.title', 'keyboard') }}
         {% endif -%}
         {% endif -%}
     </div>
diff --git a/templates/navigation/navigation_user.html.twig b/templates/navigation/navigation_user.html.twig
index 287ff58b2..267380c51 100644
--- a/templates/navigation/navigation_user.html.twig
+++ b/templates/navigation/navigation_user.html.twig
@@ -1,53 +1,53 @@
 {# user menu #}
 {% import 'macros/_icons.html.twig' as icons %}
-{% if is_remembered %}
+{% if is_remembered -%}
     <li class="nav-item dropdown">
         <a class="nav-link dropdown-toggle" href="#" id="userDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
             {%- set image = vich_uploader_asset(app.user, 'imageFile')|replace({'192': '032'}) -%}
-            {% if asset_exists(image) %}
+            {%- if asset_exists(image) -%}
                 <img alt="{{ 'user.image.title'|trans }}" src="{{ asset(image) }}?{{ 'now'|date('c') }}" class="avatar rounded-circle" title="{{ app.user.userIdentifier }}" width="{{ image_width(image) }}" height="{{ image_height(image) }}">
-            {% else %}
-                {{- icons.icon('user fa-lg far') -}}{{- ' ' ~ app.user.userIdentifier -}}
-            {% endif %}
+            {%- else -%}
+                {{ icons.icon('user fa-lg far') }}{{ ' ' ~ app.user.userIdentifier }}
+            {%- endif -%}
         </a>
         <div class="dropdown-menu dropdown-menu-right" aria-labelledby="userDropdown">
-        {{- icons.dropdownItem(path('app_logout'), 'index.logout', 'sign-out-alt') -}}
-        {{- icons.dropdownItem(path('user_profile_edit'), 'profile.edit.title', 'user-gear') -}}
-        {{- icons.dropdownItem(path('user_profile_change_password'), 'profile.change_password.title', 'unlock-alt') -}}
-        {% if is_test %}
-            {{- icons.dropdownItem(path('user_parameters'), 'user.parameters.title', 'user-gear') -}}
-            {{- icons.dropdownItem(path('user_theme'), 'index.menu_theme', 'file-image far', null, {'%name%': theme_name(app.request)}) -}}
+        {{ icons.dropdownItem(path('app_logout'), 'index.logout', 'sign-out-alt') }}
+        {{ icons.dropdownItem(path('user_profile_edit'), 'profile.edit.title', 'user-gear') }}
+        {{ icons.dropdownItem(path('user_profile_change_password'), 'profile.change_password.title', 'unlock-alt') }}
+        {% if is_test -%}
+            {{ icons.dropdownItem(path('user_parameters'), 'user.parameters.title', 'user-gear') }}
+            {{ icons.dropdownItem(path('user_theme'), 'index.menu_theme', 'file-image far', null, {'%name%': theme_name(app.request)}) }}
         {% endif %}
-        {% if is_admin %}
-            {{- icons.dropdownSeparator -}}
-            {{- icons.dropdownItem(path('admin_parameters'), 'parameters.title', 'cogs') -}}
-            {{- icons.dropdownItem(path('log_table'), 'log.title', ICON_LOG) -}}
-            {{- icons.dropdownItem(path('admin_clear'), 'clear_cache.title', 'times') -}}
-            {{- icons.dropdownSeparator -}}
-            {{- icons.dropdownItem(path('user_table'), 'user.list.title', ICON_USER) -}}
-            {{- icons.dropdownItem(path('admin_rights_user'), 'index.menu_rights_user', 'unlock-alt') -}}
+        {% if is_admin -%}
+            {{ icons.dropdownSeparator }}
+            {{ icons.dropdownItem(path('admin_parameters'), 'parameters.title', 'cogs') }}
+            {{ icons.dropdownItem(path('log_table'), 'log.title', ICON_LOG) }}
+            {{ icons.dropdownItem(path('admin_clear'), 'clear_cache.title', 'times') }}
+            {{ icons.dropdownSeparator }}
+            {{ icons.dropdownItem(path('user_table'), 'user.list.title', ICON_USER) }}
+            {{ icons.dropdownItem(path('admin_rights_user'), 'index.menu_rights_user', 'unlock-alt') }}
         {% endif %}
-        {% if is_super_admin %}
-            {{- icons.dropdownItem(path('admin_rights_admin'), 'index.menu_rights_admin', 'unlock-alt') -}}
+        {% if is_super_admin -%}
+            {{ icons.dropdownItem(path('admin_rights_admin'), 'index.menu_rights_admin', 'unlock-alt') }}
         {% endif %}
-        {% if is_previous_admin %}
-            {{- icons.dropdownSeparator -}}
-            {{- icons.dropdownItem(impersonation_exit_path(path('user_table')), 'user.switch.exit.title', 'user-slash') -}}
+        {% if is_previous_admin -%}
+            {{ icons.dropdownSeparator }}
+            {{ icons.dropdownItem(impersonation_exit_path(path('user_table')), 'user.switch.exit.title', 'user-slash') }}
         {% endif %}
         {# switch environment #}
-        {% if is_env_dev %}
-            {{- icons.dropdownSeparator -}}
-            {{- icons.dropdownItem(link_prod, 'environment.switch', 'location-arrow', null, {'%name%': 'environment.prod'|trans}) -}}
-        {% elseif is_env_prod or is_env_local %}
-            {{- icons.dropdownSeparator -}}
-            {{- icons.dropdownItem(link_dev, 'environment.switch', 'location-arrow', null, {'%name%': 'environment.dev'|trans}) -}}
+        {% if is_env_dev -%}
+            {{ icons.dropdownSeparator }}
+            {{ icons.dropdownItem(link_prod, 'environment.switch', 'location-arrow', null, {'%name%': 'environment.prod'|trans}) }}
+        {% elseif is_env_prod or is_env_local -%}
+            {{ icons.dropdownSeparator }}
+            {{ icons.dropdownItem(link_dev, 'environment.switch', 'location-arrow', null, {'%name%': 'environment.dev'|trans}) }}
         {% endif %}
-        {{- icons.dropdownSeparator -}}
-        {{- icons.dropdownItem(path('site_map'), 'index.menu_site_map', 'sitemap') -}}
-        {{- icons.dropdownItem(path('user_comment'), 'user.comment.title', 'envelope far') -}}
-        {{- icons.dropdownItem(path('about'), 'index.menu_info', 'info-circle', null, {'%app_name%': app_name}) -}}
+        {{ icons.dropdownSeparator }}
+        {{ icons.dropdownItem(path('site_map'), 'index.menu_site_map', 'sitemap') }}
+        {{ icons.dropdownItem(path('user_comment'), 'user.comment.title', 'envelope far') }}
+        {{ icons.dropdownItem(path('about'), 'index.menu_info', 'info-circle', null, {'%app_name%': app_name}) }}
         </div>
     </li>
 {% else %}
-    {{- icons.navItem(path('app_login'), 'index.login', 'sign-in') -}}
+    {{ icons.navItem(path('app_login'), 'index.login', 'sign-in') }}
 {% endif -%}
diff --git a/templates/test/recaptcha.html.twig b/templates/test/recaptcha.html.twig
index 233d3dc72..7c0010e3a 100644
--- a/templates/test/recaptcha.html.twig
+++ b/templates/test/recaptcha.html.twig
@@ -6,8 +6,8 @@
 {%- set cancel_path = path('homepage') -%}
 {%- set submit_params = {'disabled': 'disabled'} -%}
 {%- set form_attr = form_attr|default({})|merge({
-        'data-key': google_recaptcha_site_key,
-        'data-action': recaptcha_action
+    'data-action': google_recaptcha_action,
+    'data-key': google_recaptcha_site_key
 }) -%}
 
 {% block card_body %}
@@ -19,6 +19,6 @@
 
 {% block javascripts -%}
 {{ parent() }}
-<script src="https://www.google.com/recaptcha/api.js?render={{ google_recaptcha_site_key }}"></script>
+<script src="https://www.google.com/recaptcha/api.js?render={{ google_recaptcha_site_key }}" nonce="{{ csp_nonce() }}"></script>
 {{ asset_js('js/test/recaptcha.js') }}
 {%- endblock %}
diff --git a/templates/test/translate.html.twig b/templates/test/translate.html.twig
index 8a919b05a..4468570f6 100644
--- a/templates/test/translate.html.twig
+++ b/templates/test/translate.html.twig
@@ -98,7 +98,7 @@
 {% block javascripts -%}
 {{ parent() }}
 {{ asset_js('js/vendor/select2/js/select2.js') }}
-{{ asset_js('js/vendor/select2/js/i18n/fr.min.js') }}
+{{ asset_js('js/vendor/select2/js/i18n/fr.js') }}
 {{ asset_js('js/extensions/select2-extensions.js') }}
 {{ asset_js('js/vendor/clipboard/clipboard.js') }}
 {{ asset_js('js/test/translate.js') }}
diff --git a/translations/messages.fr_CH.yaml b/translations/messages.fr_CH.yaml
index 7ab8cfd17..a924d58ab 100644
--- a/translations/messages.fr_CH.yaml
+++ b/translations/messages.fr_CH.yaml
@@ -1400,3 +1400,8 @@ archive:
     date: Date limite
     target: Nouveau statut
     sources: Anciens status
+notification:
+  csp_title: Violation de règles CSP
+  csp_description: L'agent utilisateur de l'application %name% a rapporté des violations des règles de la politique de sécurité de contenu (Content Security Policy).
+  footer: Notification envoyée par l'application %name%.
+  exception: La trace de la pile d'exception est en pièce jointe.
diff --git a/vendor-bin/phpstan/composer.lock b/vendor-bin/phpstan/composer.lock
index 6c0d43c9a..1c9cb473b 100644
--- a/vendor-bin/phpstan/composer.lock
+++ b/vendor-bin/phpstan/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "nikic/php-parser",
-            "version": "v4.13.2",
+            "version": "v4.14.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077"
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/210577fe3cf7badcc5814d99455df46564f3c077",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/34bea19b6e03d8153165d8f30bba4c3be86184c1",
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1",
                 "shasum": ""
             },
             "require": {
@@ -58,9 +58,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v4.13.2"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v4.14.0"
             },
-            "time": "2021-11-30T19:35:32+00:00"
+            "time": "2022-05-31T20:59:12+00:00"
         },
         {
             "name": "phpstan/extension-installer",
@@ -109,16 +109,16 @@
         },
         {
             "name": "phpstan/phpstan",
-            "version": "1.7.7",
+            "version": "1.7.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab"
+                "reference": "2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab",
-                "reference": "cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a",
+                "reference": "2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a",
                 "shasum": ""
             },
             "require": {
@@ -144,7 +144,7 @@
             "description": "PHPStan - PHP Static Analysis Tool",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan/issues",
-                "source": "https://github.com/phpstan/phpstan/tree/1.7.7"
+                "source": "https://github.com/phpstan/phpstan/tree/1.7.8"
             },
             "funding": [
                 {
@@ -164,7 +164,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-05-31T13:58:21+00:00"
+            "time": "2022-06-01T13:43:17+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",
@@ -218,21 +218,21 @@
         },
         {
             "name": "phpstan/phpstan-doctrine",
-            "version": "1.3.6",
+            "version": "1.3.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan-doctrine.git",
-                "reference": "317e47b31bb92df5b344ed208dd358a6099c8507"
+                "reference": "85339d71b2dde4871d84bc369002fa1a3b460b07"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/317e47b31bb92df5b344ed208dd358a6099c8507",
-                "reference": "317e47b31bb92df5b344ed208dd358a6099c8507",
+                "url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/85339d71b2dde4871d84bc369002fa1a3b460b07",
+                "reference": "85339d71b2dde4871d84bc369002fa1a3b460b07",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.2 || ^8.0",
-                "phpstan/phpstan": "^1.7.0"
+                "phpstan/phpstan": "^1.7.3"
             },
             "conflict": {
                 "doctrine/collections": "<1.0",
@@ -280,9 +280,9 @@
             "description": "Doctrine extensions for PHPStan",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan-doctrine/issues",
-                "source": "https://github.com/phpstan/phpstan-doctrine/tree/1.3.6"
+                "source": "https://github.com/phpstan/phpstan-doctrine/tree/1.3.7"
             },
-            "time": "2022-05-27T18:47:50+00:00"
+            "time": "2022-06-01T13:19:10+00:00"
         },
         {
             "name": "phpstan/phpstan-phpunit",
diff --git a/vendor-bin/phpunit/composer.lock b/vendor-bin/phpunit/composer.lock
index 3feaa279f..53884adcc 100644
--- a/vendor-bin/phpunit/composer.lock
+++ b/vendor-bin/phpunit/composer.lock
@@ -137,16 +137,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v4.13.2",
+            "version": "v4.14.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077"
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/210577fe3cf7badcc5814d99455df46564f3c077",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/34bea19b6e03d8153165d8f30bba4c3be86184c1",
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1",
                 "shasum": ""
             },
             "require": {
@@ -187,9 +187,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v4.13.2"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v4.14.0"
             },
-            "time": "2021-11-30T19:35:32+00:00"
+            "time": "2022-05-31T20:59:12+00:00"
         },
         {
             "name": "phar-io/manifest",
diff --git a/vendor-bin/psalm/composer.lock b/vendor-bin/psalm/composer.lock
index a1fcad04f..9dc13496d 100644
--- a/vendor-bin/psalm/composer.lock
+++ b/vendor-bin/psalm/composer.lock
@@ -654,16 +654,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v4.13.2",
+            "version": "v4.14.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077"
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/210577fe3cf7badcc5814d99455df46564f3c077",
-                "reference": "210577fe3cf7badcc5814d99455df46564f3c077",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/34bea19b6e03d8153165d8f30bba4c3be86184c1",
+                "reference": "34bea19b6e03d8153165d8f30bba4c3be86184c1",
                 "shasum": ""
             },
             "require": {
@@ -704,9 +704,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v4.13.2"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v4.14.0"
             },
-            "time": "2021-11-30T19:35:32+00:00"
+            "time": "2022-05-31T20:59:12+00:00"
         },
         {
             "name": "openlss/lib-array2xml",
diff --git a/vendor-bin/rector/composer.lock b/vendor-bin/rector/composer.lock
index 625497b5e..e51fa6fff 100644
--- a/vendor-bin/rector/composer.lock
+++ b/vendor-bin/rector/composer.lock
@@ -8,16 +8,16 @@
     "packages": [
         {
             "name": "phpstan/phpstan",
-            "version": "1.7.7",
+            "version": "1.7.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab"
+                "reference": "2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab",
-                "reference": "cadad14ac63d8a432e01ae89ac5d0ff6fc3b16ab",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a",
+                "reference": "2bf3d43015d56abac4d002a4d2d6c3a7d6fa627a",
                 "shasum": ""
             },
             "require": {
@@ -43,7 +43,7 @@
             "description": "PHPStan - PHP Static Analysis Tool",
             "support": {
                 "issues": "https://github.com/phpstan/phpstan/issues",
-                "source": "https://github.com/phpstan/phpstan/tree/1.7.7"
+                "source": "https://github.com/phpstan/phpstan/tree/1.7.8"
             },
             "funding": [
                 {
@@ -63,7 +63,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-05-31T13:58:21+00:00"
+            "time": "2022-06-01T13:43:17+00:00"
         },
         {
             "name": "rector/rector",