Repository: primefaces/primefaces (java)

Issue:
CSP report only mode with custom rules
### Describe the bug

When setting the primefaces.CSP_REPORT_ONLY_POLICY context parameter in web.xml as follows:

```xml
<context-param>
  <param-name>primefaces.CSP_REPORT_ONLY_POLICY</param-name>
  <param-value>
    frame-src 'self'; frame-ancestors 'self'; base-uri 'none'; object-src 'self'; report-uri /KnzWEB/csp-reports; script-src 'self' 'report-sample' 'unsafe-eval' https://www.someurl.com
  </param-value>
</context-param>
```

generate this csp header:

```
Content-Security-Policy-Report-Only:
  script-src 'self' 'nonce-NmI1YzFkNGItMDk5MC00MzQwLTliMjMtNTdmYTIwYjg0Yzhk'; 
  frame-src 'self'; 
  frame-ancestors 'self'; 
  base-uri 'none'; 
  object-src 'self'; 
  report-uri /KnzWEB/csp-reports; 
  script-src 'self' 'report-sample' 'unsafe-eval' https://www.someurl.com;
```

### Reproducer

_No response_

### Expected behavior

The behavior for primefaces.CSP_REPORT_ONLY_POLICY should be consistent with primefaces.CSP_POLICY.
```java
        if (LangUtils.isNotBlank(reportOnlyPolicy)) {
            String policy = "script-src 'self' 'nonce-" + state.getNonce() + "'; " + reportOnlyPolicy + ";";
            externalContext.addResponseHeader("Content-Security-Policy-Report-Only", policy);
        }
        else {
            String policy = LangUtils.isBlank(customPolicy) ? "script-src 'self'" : customPolicy;
            policy += " 'nonce-" + state.getNonce() + "';";
            externalContext.addResponseHeader("Content-Security-Policy", policy);
        }
```

### PrimeFaces edition

None

### PrimeFaces version

13.0.10

### Theme

_No response_

### JSF implementation

Mojarra

### JSF version

2.3

### Java version

8

### Browser(s)

_No response_

Pull request:
Fix #13782: 15.0.5 CSP ReportOnlyPolicy fix
Fix #13782: 15.0.5 CSP ReportOnlyPolicy fix

Patch:
diff --git a/pom.xml b/pom.xml
index e126cee006..1b3cf4d43f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <groupId>org.primefaces</groupId>
     <artifactId>primefaces-parent</artifactId>
     <packaging>pom</packaging>
-    <version>15.0.4</version>
+    <version>15.0.5-SNAPSHOT</version>
 
     <name>PrimeFaces Parent</name>
     <url>https://www.primefaces.org</url>
diff --git a/primefaces-cli/pom.xml b/primefaces-cli/pom.xml
index 6786d85c59..fc3175490a 100644
--- a/primefaces-cli/pom.xml
+++ b/primefaces-cli/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-coverage/pom.xml b/primefaces-coverage/pom.xml
index 39d3beeee7..d25466705d 100644
--- a/primefaces-coverage/pom.xml
+++ b/primefaces-coverage/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-selenium/pom.xml b/primefaces-selenium/pom.xml
index fa9d336b72..05814306f2 100644
--- a/primefaces-selenium/pom.xml
+++ b/primefaces-selenium/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-selenium/primefaces-selenium-components/pom.xml b/primefaces-selenium/primefaces-selenium-components/pom.xml
index eaa1a36af5..e1981fea08 100644
--- a/primefaces-selenium/primefaces-selenium-components/pom.xml
+++ b/primefaces-selenium/primefaces-selenium-components/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-selenium</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-selenium/primefaces-selenium-core/pom.xml b/primefaces-selenium/primefaces-selenium-core/pom.xml
index 8e29ed05b9..cc4bd498ee 100644
--- a/primefaces-selenium/primefaces-selenium-core/pom.xml
+++ b/primefaces-selenium/primefaces-selenium-core/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-selenium</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-showcase/pom.xml b/primefaces-showcase/pom.xml
index 3104542ec4..710b275724 100644
--- a/primefaces-showcase/pom.xml
+++ b/primefaces-showcase/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-themes/pom.xml b/primefaces-themes/pom.xml
index 894900658d..2d1f125f65 100644
--- a/primefaces-themes/pom.xml
+++ b/primefaces-themes/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>primefaces-themes</artifactId>
diff --git a/primefaces/pom.xml b/primefaces/pom.xml
index a20bd51569..7d239b99b7 100644
--- a/primefaces/pom.xml
+++ b/primefaces/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces/src/main/java/org/primefaces/csp/CspPhaseListener.java b/primefaces/src/main/java/org/primefaces/csp/CspPhaseListener.java
index fac0f8c4c2..7dff784038 100644
--- a/primefaces/src/main/java/org/primefaces/csp/CspPhaseListener.java
+++ b/primefaces/src/main/java/org/primefaces/csp/CspPhaseListener.java
@@ -88,7 +88,7 @@ public class CspPhaseListener implements PhaseListener {
         state.setInitialized(true);
 
         if (LangUtils.isNotBlank(reportOnlyPolicy)) {
-            String policy = "script-src 'self' 'nonce-" + state.getNonce() + "'; " + reportOnlyPolicy + ";";
+            String policy = reportOnlyPolicy + " 'nonce-" + state.getNonce() + "';";
             externalContext.addResponseHeader("Content-Security-Policy-Report-Only", policy);
         }
         else {


Test patch:
diff --git a/primefaces-integration-tests-jakarta/pom.xml b/primefaces-integration-tests-jakarta/pom.xml
index 46442c1515..e2cc9ecf1f 100644
--- a/primefaces-integration-tests-jakarta/pom.xml
+++ b/primefaces-integration-tests-jakarta/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
diff --git a/primefaces-integration-tests/pom.xml b/primefaces-integration-tests/pom.xml
index 9db33bb5ad..8988d8e56f 100644
--- a/primefaces-integration-tests/pom.xml
+++ b/primefaces-integration-tests/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.primefaces</groupId>
         <artifactId>primefaces-parent</artifactId>
-        <version>15.0.4</version>
+        <version>15.0.5-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>