Bugzilla – Attachment 193312 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Add CSP nonces to all inline script and style tags
Bug-38365-Add-CSP-nonces-to-all-inline-script-and-.patch (text/plain), 384.59 KB, created by
David Cook
on 2026-02-17 05:54:15 UTC
(
hide
)
Description:
Bug 38365: Add CSP nonces to all inline script and style tags
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-17 05:54:15 UTC
Size:
384.59 KB
patch
obsolete
>From c4ed19c24baec0e35bbaf8c1e695dfb5e232c02a Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 17 Feb 2026 05:37:21 +0000 >Subject: [PATCH] Bug 38365: Add CSP nonces to all inline script and style tags > >--- > .../batch_biblio_record_modification.inc | 2 +- > .../background_jobs/erm_sushi_harvester.inc | 2 +- > .../background_jobs/import_from_kbart_file.inc | 2 +- > .../prog/en/includes/calendar.inc | 4 ++-- > .../prog/en/includes/catalog-strings.inc | 2 +- > .../prog/en/includes/cateditor-ui.inc | 6 +++--- > .../en/includes/cateditor-widgets-marc21.inc | 2 +- > .../prog/en/includes/doc-head-close.inc | 8 ++++---- > .../prog/en/includes/format_price.inc | 2 +- > .../tables/items/catalogue_detail.inc | 2 +- > .../en/includes/ill-batch-modal-strings.inc | 2 +- > .../en/includes/ill-batch-table-strings.inc | 2 +- > .../en/includes/ill-list-table-strings.inc | 2 +- > .../includes/ill/backends/Standard/create.inc | 2 +- > .../ill/backends/Standard/edititem.inc | 2 +- > .../includes/ill/backends/Standard/migrate.inc | 2 +- > .../backends/Standard/shared/custom_fields.inc | 2 +- > .../en/includes/installer-doc-head-close.inc | 4 ++-- > .../en/includes/installer-intranet-bottom.inc | 2 +- > .../prog/en/includes/installer-strings.inc | 2 +- > .../prog/en/includes/intranet-bottom.inc | 2 +- > .../prog/en/includes/js-biblio-format.inc | 3 +-- > .../prog/en/includes/js-date-format.inc | 4 ++-- > .../en/includes/js-patron-format-address.inc | 2 +- > .../prog/en/includes/js-patron-get-age.inc | 2 +- > .../prog/en/includes/js_includes.inc | 10 +++++----- > .../prog/en/includes/last-borrower.inc | 3 +-- > .../prog/en/includes/main-container.inc | 2 +- > .../en/includes/messaging-preference-form.inc | 2 +- > .../prog/en/includes/modal-claims.inc | 2 +- > .../prog/en/includes/password_check.inc | 2 +- > .../prog/en/includes/patron-search.inc | 8 ++++---- > .../prog/en/includes/slip-print.inc | 2 +- > .../en/includes/str/cataloging_additem.inc | 2 +- > .../en/includes/str/erm_sushi_harvester.inc | 2 +- > .../en/includes/str/import_from_kbart_file.inc | 2 +- > .../prog/en/includes/str/job_progress.inc | 2 +- > .../prog/en/includes/str/members-menu.inc | 2 +- > .../prog/en/includes/str/tinymce_i18n.inc | 2 +- > .../prog/en/includes/validator-strings.inc | 2 +- > .../en/includes/wysiwyg-systempreferences.inc | 2 +- > .../prog/en/includes/z3950_search.inc | 2 +- > .../intranet-tmpl/prog/en/modules/about.tt | 4 ++-- > .../prog/en/modules/acqui/acqui-home.tt | 4 ++-- > .../prog/en/modules/acqui/addorderiso2709.tt | 4 ++-- > .../prog/en/modules/acqui/basket.tt | 12 ++++++------ > .../prog/en/modules/acqui/basketgroup.tt | 4 ++-- > .../prog/en/modules/acqui/basketheader.tt | 2 +- > .../prog/en/modules/acqui/booksellers.tt | 4 ++-- > .../prog/en/modules/acqui/duplicate_orders.tt | 6 +++--- > .../prog/en/modules/acqui/edifactmsgs.tt | 2 +- > .../prog/en/modules/acqui/histsearch.tt | 4 ++-- > .../prog/en/modules/acqui/invoice-files.tt | 2 +- > .../prog/en/modules/acqui/invoice.tt | 4 ++-- > .../prog/en/modules/acqui/invoices.tt | 2 +- > .../prog/en/modules/acqui/lateorders.tt | 4 ++-- > .../prog/en/modules/acqui/neworderempty.tt | 4 ++-- > .../en/modules/acqui/newordersubscription.tt | 2 +- > .../en/modules/acqui/newordersuggestion.tt | 4 ++-- > .../prog/en/modules/acqui/ordered.tt | 2 +- > .../prog/en/modules/acqui/orderreceive.tt | 6 +++--- > .../prog/en/modules/acqui/parcel.tt | 6 +++--- > .../prog/en/modules/acqui/parcels.tt | 2 +- > .../prog/en/modules/acqui/spent.tt | 2 +- > .../prog/en/modules/acqui/transferorder.tt | 4 ++-- > .../prog/en/modules/acqui/uncertainprice.tt | 2 +- > .../prog/en/modules/acqui/vendor_issues.tt | 4 ++-- > .../prog/en/modules/acqui/vendors.tt | 2 +- > .../prog/en/modules/acqui/z3950_search.tt | 4 ++-- > .../prog/en/modules/admin/additional-fields.tt | 2 +- > .../prog/en/modules/admin/aqbudgetperiods.tt | 8 ++++---- > .../prog/en/modules/admin/aqbudgets.tt | 8 ++++---- > .../prog/en/modules/admin/aqcontract.tt | 2 +- > .../prog/en/modules/admin/aqplan.tt | 4 ++-- > .../modules/admin/auth_subfields_structure.tt | 4 ++-- > .../en/modules/admin/auth_tag_structure.tt | 2 +- > .../prog/en/modules/admin/authorised_values.tt | 4 ++-- > .../prog/en/modules/admin/background_jobs.tt | 4 ++-- > .../prog/en/modules/admin/biblio_framework.tt | 2 +- > .../en/modules/admin/branch_transfer_limits.tt | 6 +++--- > .../prog/en/modules/admin/branches.tt | 10 +++++----- > .../prog/en/modules/admin/cash_registers.tt | 2 +- > .../prog/en/modules/admin/categories.tt | 6 +++--- > .../prog/en/modules/admin/cities.tt | 4 ++-- > .../prog/en/modules/admin/classsources.tt | 4 ++-- > .../prog/en/modules/admin/columns_settings.tt | 4 ++-- > .../prog/en/modules/admin/credit_types.tt | 2 +- > .../prog/en/modules/admin/curbside_pickup.tt | 4 ++-- > .../prog/en/modules/admin/currency.tt | 4 ++-- > .../prog/en/modules/admin/debit_types.tt | 2 +- > .../prog/en/modules/admin/desks.tt | 2 +- > .../prog/en/modules/admin/didyoumean.tt | 2 +- > .../prog/en/modules/admin/edi_accounts.tt | 4 ++-- > .../prog/en/modules/admin/file_transports.tt | 4 ++-- > .../prog/en/modules/admin/float_limits.tt | 4 ++-- > .../modules/admin/identity_provider_domains.tt | 4 ++-- > .../en/modules/admin/identity_providers.tt | 2 +- > .../modules/admin/item_circulation_alerts.tt | 4 ++-- > .../prog/en/modules/admin/itemtypes.tt | 6 +++--- > .../prog/en/modules/admin/koha2marclinks.tt | 2 +- > .../prog/en/modules/admin/library_groups.tt | 2 +- > .../prog/en/modules/admin/localization.tt | 6 +++--- > .../en/modules/admin/marc-overlay-rules.tt | 6 +++--- > .../en/modules/admin/marc_order_accounts.tt | 2 +- > .../modules/admin/marc_subfields_structure.tt | 4 ++-- > .../prog/en/modules/admin/marctagstructure.tt | 2 +- > .../prog/en/modules/admin/matching-rules.tt | 4 ++-- > .../prog/en/modules/admin/oai_servers.tt | 6 +++--- > .../prog/en/modules/admin/oai_set_mappings.tt | 2 +- > .../prog/en/modules/admin/oai_sets.tt | 2 +- > .../prog/en/modules/admin/overdrive.tt | 2 +- > .../prog/en/modules/admin/patron-attr-types.tt | 2 +- > .../prog/en/modules/admin/preferences.tt | 2 +- > .../prog/en/modules/admin/restrictions.tt | 2 +- > .../prog/en/modules/admin/search_filters.tt | 2 +- > .../searchengine/elasticsearch/mappings.tt | 2 +- > .../prog/en/modules/admin/share_content.tt | 2 +- > .../prog/en/modules/admin/smart-rules.tt | 2 +- > .../prog/en/modules/admin/smtp_servers.tt | 4 ++-- > .../prog/en/modules/admin/sru_modmapping.tt | 2 +- > .../en/modules/admin/sru_modmapping_auth.tt | 2 +- > .../prog/en/modules/admin/systempreferences.tt | 6 +++--- > .../prog/en/modules/admin/transfer_limits.tt | 4 ++-- > .../en/modules/admin/transport-cost-matrix.tt | 4 ++-- > .../prog/en/modules/admin/usage_statistics.tt | 2 +- > .../prog/en/modules/admin/z3950servers.tt | 6 +++--- > .../intranet-tmpl/prog/en/modules/auth.tt | 2 +- > .../prog/en/modules/authorities/auth_finder.tt | 2 +- > .../en/modules/authorities/authorities-home.tt | 2 +- > .../prog/en/modules/authorities/authorities.tt | 6 +++--- > .../authorities/blinddetail-biblio-search.tt | 2 +- > .../prog/en/modules/authorities/detail.tt | 4 ++-- > .../prog/en/modules/authorities/merge.tt | 6 +++--- > .../authorities/searchresultlist-auth.tt | 6 +++--- > .../en/modules/authorities/searchresultlist.tt | 4 ++-- > .../prog/en/modules/batch/print-notices.tt | 2 +- > .../prog/en/modules/bookings/list.tt | 8 ++++---- > .../prog/en/modules/catalogue/ISBDdetail.tt | 8 ++++---- > .../prog/en/modules/catalogue/MARCdetail.tt | 8 ++++---- > .../prog/en/modules/catalogue/advsearch.tt | 2 +- > .../prog/en/modules/catalogue/detail.tt | 12 ++++++------ > .../prog/en/modules/catalogue/imageviewer.tt | 10 +++++----- > .../prog/en/modules/catalogue/issuehistory.tt | 2 +- > .../prog/en/modules/catalogue/itemsearch.tt | 2 +- > .../en/modules/catalogue/labeledMARCdetail.tt | 8 ++++---- > .../prog/en/modules/catalogue/moredetail.tt | 10 +++++----- > .../prog/en/modules/catalogue/results.tt | 2 +- > .../en/modules/catalogue/search-history.tt | 2 +- > .../prog/en/modules/catalogue/showelastic.tt | 4 ++-- > .../prog/en/modules/catalogue/stockrotation.tt | 2 +- > .../prog/en/modules/cataloguing/addbiblio.tt | 6 +++--- > .../prog/en/modules/cataloguing/addbooks.tt | 2 +- > .../prog/en/modules/cataloguing/additem.tt | 6 +++--- > .../en/modules/cataloguing/cataloging-home.tt | 2 +- > .../prog/en/modules/cataloguing/concerns.tt | 2 +- > .../prog/en/modules/cataloguing/merge.tt | 4 ++-- > .../prog/en/modules/cataloguing/moveitem.tt | 2 +- > .../cataloguing/value_builder/EXAMPLE.tt | 2 +- > .../value_builder/marc21_field_006.tt | 2 +- > .../value_builder/marc21_field_007.tt | 2 +- > .../value_builder/marc21_field_008.tt | 2 +- > .../marc21_field_008_authorities.tt | 2 +- > .../marc21_field_008_classifications.tt | 2 +- > .../cataloguing/value_builder/marc21_leader.tt | 2 +- > .../value_builder/marc21_leader_authorities.tt | 2 +- > .../value_builder/marc21_linking_section.tt | 6 +++--- > .../value_builder/unimarc_field_100.tt | 2 +- > .../unimarc_field_100_authorities.tt | 2 +- > .../value_builder/unimarc_field_105.tt | 2 +- > .../value_builder/unimarc_field_106.tt | 2 +- > .../value_builder/unimarc_field_110.tt | 2 +- > .../value_builder/unimarc_field_115a.tt | 2 +- > .../value_builder/unimarc_field_115b.tt | 2 +- > .../value_builder/unimarc_field_116.tt | 2 +- > .../value_builder/unimarc_field_117.tt | 2 +- > .../value_builder/unimarc_field_120.tt | 2 +- > .../value_builder/unimarc_field_121a.tt | 2 +- > .../value_builder/unimarc_field_121b.tt | 2 +- > .../value_builder/unimarc_field_122.tt | 2 +- > .../value_builder/unimarc_field_123a.tt | 2 +- > .../value_builder/unimarc_field_123defg.tt | 2 +- > .../value_builder/unimarc_field_123i_j.tt | 2 +- > .../value_builder/unimarc_field_124a.tt | 2 +- > .../value_builder/unimarc_field_124b.tt | 2 +- > .../value_builder/unimarc_field_124c.tt | 2 +- > .../value_builder/unimarc_field_124d.tt | 2 +- > .../value_builder/unimarc_field_124e.tt | 2 +- > .../value_builder/unimarc_field_124f.tt | 2 +- > .../value_builder/unimarc_field_124g.tt | 2 +- > .../value_builder/unimarc_field_125a.tt | 2 +- > .../value_builder/unimarc_field_125b.tt | 2 +- > .../value_builder/unimarc_field_126a.tt | 2 +- > .../value_builder/unimarc_field_126b.tt | 2 +- > .../value_builder/unimarc_field_127.tt | 2 +- > .../value_builder/unimarc_field_128a.tt | 2 +- > .../value_builder/unimarc_field_128b.tt | 2 +- > .../value_builder/unimarc_field_128c.tt | 2 +- > .../value_builder/unimarc_field_130.tt | 2 +- > .../value_builder/unimarc_field_135a.tt | 2 +- > .../value_builder/unimarc_field_140.tt | 2 +- > .../value_builder/unimarc_field_141.tt | 2 +- > .../value_builder/unimarc_field_146a.tt | 2 +- > .../value_builder/unimarc_field_146b.tt | 4 ++-- > .../value_builder/unimarc_field_146c.tt | 4 ++-- > .../value_builder/unimarc_field_146d.tt | 4 ++-- > .../value_builder/unimarc_field_146e.tt | 4 ++-- > .../value_builder/unimarc_field_146f.tt | 4 ++-- > .../value_builder/unimarc_field_146h.tt | 2 +- > .../value_builder/unimarc_field_146i.tt | 2 +- > .../value_builder/unimarc_field_181-2.tt | 2 +- > .../value_builder/unimarc_field_181a.tt | 2 +- > .../value_builder/unimarc_field_181b.tt | 2 +- > .../value_builder/unimarc_field_181c.tt | 2 +- > .../value_builder/unimarc_field_182-2.tt | 2 +- > .../value_builder/unimarc_field_182a.tt | 2 +- > .../value_builder/unimarc_field_182c.tt | 2 +- > .../value_builder/unimarc_field_183-2.tt | 2 +- > .../value_builder/unimarc_field_183a.tt | 2 +- > .../value_builder/unimarc_field_210c.tt | 2 +- > .../value_builder/unimarc_field_210c_bis.tt | 2 +- > .../value_builder/unimarc_field_225a.tt | 2 +- > .../value_builder/unimarc_field_225a_bis.tt | 2 +- > .../value_builder/unimarc_field_283-2.tt | 2 +- > .../value_builder/unimarc_field_283a.tt | 2 +- > .../value_builder/unimarc_field_325h.tt | 2 +- > .../value_builder/unimarc_field_325j.tt | 2 +- > .../value_builder/unimarc_field_4XX.tt | 4 ++-- > .../value_builder/unimarc_leader.tt | 2 +- > .../unimarc_leader_authorities.tt | 2 +- > .../modules/cataloguing/z3950_auth_search.tt | 2 +- > .../en/modules/cataloguing/z3950_search.tt | 2 +- > .../prog/en/modules/circ/article-requests.tt | 4 ++-- > .../prog/en/modules/circ/bookcount.tt | 2 +- > .../prog/en/modules/circ/branchtransfers.tt | 4 ++-- > .../prog/en/modules/circ/checkout-notes.tt | 2 +- > .../prog/en/modules/circ/circulation.tt | 6 +++--- > .../circ/circulation_batch_checkouts.tt | 4 ++-- > .../prog/en/modules/circ/curbside_pickups.tt | 8 ++++---- > .../prog/en/modules/circ/on-site_checkouts.tt | 2 +- > .../prog/en/modules/circ/overdue.tt | 4 ++-- > .../prog/en/modules/circ/pendingbookings.tt | 2 +- > .../prog/en/modules/circ/pendingreserves.tt | 2 +- > .../prog/en/modules/circ/printslip.tt | 2 +- > .../prog/en/modules/circ/renew.tt | 2 +- > .../prog/en/modules/circ/request-article.tt | 2 +- > .../prog/en/modules/circ/reserveratios.tt | 4 ++-- > .../prog/en/modules/circ/returns.tt | 6 +++--- > .../prog/en/modules/circ/set-library.tt | 2 +- > .../prog/en/modules/circ/transfers_to_send.tt | 2 +- > .../prog/en/modules/circ/transferstoreceive.tt | 2 +- > .../prog/en/modules/circ/view_holdsqueue.tt | 4 ++-- > .../prog/en/modules/circ/waitingreserves.tt | 4 ++-- > .../prog/en/modules/clubs/club-enrollments.tt | 2 +- > .../prog/en/modules/clubs/clubs.tt | 2 +- > .../prog/en/modules/clubs/patron-clubs-tab.tt | 2 +- > .../prog/en/modules/clubs/patron-enroll.tt | 2 +- > .../en/modules/clubs/templates-add-modify.tt | 4 ++-- > .../modules/course_reserves/add_items-step1.tt | 2 +- > .../modules/course_reserves/add_items-step2.tt | 2 +- > .../modules/course_reserves/batch_add_items.tt | 2 +- > .../modules/course_reserves/batch_rm_items.tt | 2 +- > .../modules/course_reserves/course-details.tt | 4 ++-- > .../modules/course_reserves/course-reserves.tt | 2 +- > .../prog/en/modules/course_reserves/course.tt | 4 ++-- > .../intranet-tmpl/prog/en/modules/erm/erm.tt | 2 +- > .../prog/en/modules/ill/ill-requests.tt | 12 ++++++------ > .../prog/en/modules/installer/step3.tt | 2 +- > .../prog/en/modules/intranet-main.tt | 2 +- > .../prog/en/modules/labels/barcode-print.tt | 4 ++-- > .../prog/en/modules/labels/label-edit-batch.tt | 2 +- > .../en/modules/labels/label-edit-layout.tt | 2 +- > .../en/modules/labels/label-edit-profile.tt | 2 +- > .../prog/en/modules/labels/label-edit-range.tt | 2 +- > .../en/modules/labels/label-edit-template.tt | 2 +- > .../prog/en/modules/labels/label-manage.tt | 2 +- > .../prog/en/modules/labels/label-print.tt | 2 +- > .../prog/en/modules/labels/result.tt | 2 +- > .../prog/en/modules/labels/spinelabel-home.tt | 2 +- > .../prog/en/modules/labels/spinelabel-print.tt | 6 +++--- > .../en/modules/members/alert-subscriptions.tt | 2 +- > .../prog/en/modules/members/apikeys.tt | 2 +- > .../prog/en/modules/members/boraccount.tt | 2 +- > .../prog/en/modules/members/discharges.tt | 2 +- > .../prog/en/modules/members/files.tt | 2 +- > .../prog/en/modules/members/holdshistory.tt | 4 ++-- > .../prog/en/modules/members/housebound.tt | 2 +- > .../prog/en/modules/members/ill-requests.tt | 2 +- > .../prog/en/modules/members/mancredit.tt | 2 +- > .../prog/en/modules/members/maninvoice.tt | 2 +- > .../prog/en/modules/members/member-flags.tt | 2 +- > .../prog/en/modules/members/member-password.tt | 2 +- > .../prog/en/modules/members/member.tt | 4 ++-- > .../prog/en/modules/members/memberentrygen.tt | 2 +- > .../prog/en/modules/members/members-update.tt | 2 +- > .../prog/en/modules/members/merge-patrons.tt | 4 ++-- > .../en/modules/members/moremember-print.tt | 4 ++-- > .../prog/en/modules/members/moremember.tt | 4 ++-- > .../prog/en/modules/members/notices.tt | 2 +- > .../prog/en/modules/members/pay.tt | 2 +- > .../prog/en/modules/members/paycollect.tt | 2 +- > .../prog/en/modules/members/printfeercpt.tt | 2 +- > .../prog/en/modules/members/printinvoice.tt | 2 +- > .../prog/en/modules/members/printnotice.tt | 2 +- > .../en/modules/members/purchase-suggestions.tt | 2 +- > .../prog/en/modules/members/readingrec.tt | 2 +- > .../prog/en/modules/members/statistics.tt | 2 +- > .../prog/en/modules/members/two_factor_auth.tt | 2 +- > .../prog/en/modules/members/update-child.tt | 4 ++-- > .../prog/en/modules/offline_circ/list.tt | 2 +- > .../en/modules/offline_circ/process_koc.tt | 2 +- > .../prog/en/modules/patron_lists/list.tt | 4 ++-- > .../prog/en/modules/patron_lists/lists.tt | 2 +- > .../modules/patron_lists/patron-lists-tab.tt | 2 +- > .../prog/en/modules/patroncards/edit-batch.tt | 2 +- > .../prog/en/modules/patroncards/edit-layout.tt | 2 +- > .../en/modules/patroncards/edit-profile.tt | 2 +- > .../en/modules/patroncards/edit-template.tt | 2 +- > .../en/modules/patroncards/image-manage.tt | 2 +- > .../prog/en/modules/patroncards/manage.tt | 2 +- > .../prog/en/modules/plugins/plugins-home.tt | 2 +- > .../intranet-tmpl/prog/en/modules/pos/pay.tt | 2 +- > .../prog/en/modules/pos/printreceipt.tt | 2 +- > .../prog/en/modules/pos/register.tt | 2 +- > .../prog/en/modules/pos/registers.tt | 2 +- > .../prog/en/modules/preservation/home.tt | 2 +- > .../prog/en/modules/recalls/recalls_to_pull.tt | 2 +- > .../prog/en/modules/recalls/recalls_waiting.tt | 2 +- > .../prog/en/modules/reports/borrowers_stats.tt | 2 +- > .../en/modules/reports/cash_register_stats.tt | 2 +- > .../prog/en/modules/reports/catalogue_out.tt | 2 +- > .../prog/en/modules/reports/catalogue_stats.tt | 2 +- > .../prog/en/modules/reports/dictionary.tt | 4 ++-- > .../en/modules/reports/guided_reports_start.tt | 4 ++-- > .../prog/en/modules/reports/issues_stats.tt | 2 +- > .../prog/en/modules/reports/itemslost.tt | 2 +- > .../prog/en/modules/reports/itemtypes.tt | 2 +- > .../en/modules/reports/orders_by_budget.tt | 2 +- > .../prog/en/modules/reports/reserves_stats.tt | 4 ++-- > .../prog/en/modules/reports/serials_stats.tt | 4 ++-- > .../prog/en/modules/reserve/request.tt | 10 +++++----- > .../prog/en/modules/reviews/reviewswaiting.tt | 2 +- > .../en/modules/serials/acqui-search-result.tt | 2 +- > .../prog/en/modules/serials/checkexpiration.tt | 2 +- > .../prog/en/modules/serials/claims.tt | 2 +- > .../prog/en/modules/serials/result.tt | 2 +- > .../en/modules/serials/routing-preview-slip.tt | 4 ++-- > .../prog/en/modules/serials/routing-preview.tt | 2 +- > .../prog/en/modules/serials/routing.tt | 4 ++-- > .../en/modules/serials/serials-collection.tt | 4 ++-- > .../prog/en/modules/serials/serials-edit.tt | 4 ++-- > .../prog/en/modules/serials/serials-home.tt | 2 +- > .../prog/en/modules/serials/serials-search.tt | 6 +++--- > .../en/modules/serials/subscription-add.tt | 4 ++-- > .../en/modules/serials/subscription-detail.tt | 4 ++-- > .../serials/subscription-frequencies.tt | 2 +- > .../serials/subscription-numberpatterns.tt | 2 +- > .../en/modules/serials/subscription-renew.tt | 2 +- > .../intranet-tmpl/prog/en/modules/sip2/sip2.tt | 2 +- > .../prog/en/modules/suggestion/suggestion.tt | 10 +++++----- > .../intranet-tmpl/prog/en/modules/tags/list.tt | 4 ++-- > .../prog/en/modules/tags/review.tt | 2 +- > .../prog/en/modules/tools/access_files.tt | 2 +- > .../en/modules/tools/additional-contents.tt | 14 +++++++------- > .../automatic_item_modification_by_age.tt | 2 +- > .../prog/en/modules/tools/batchMod-del.tt | 4 ++-- > .../prog/en/modules/tools/batchMod-edit.tt | 4 ++-- > .../en/modules/tools/batch_delete_records.tt | 2 +- > .../en/modules/tools/batch_extend_due_dates.tt | 2 +- > .../en/modules/tools/batch_modify_holds.tt | 2 +- > .../modules/tools/batch_record_modification.tt | 2 +- > .../prog/en/modules/tools/cleanborrowers.tt | 2 +- > .../prog/en/modules/tools/csv-profiles.tt | 2 +- > .../prog/en/modules/tools/export.tt | 4 ++-- > .../prog/en/modules/tools/holidays.tt | 2 +- > .../prog/en/modules/tools/import_borrowers.tt | 4 ++-- > .../prog/en/modules/tools/inventory.tt | 4 ++-- > .../prog/en/modules/tools/letter.tt | 4 ++-- > .../en/modules/tools/manage-marc-import.tt | 4 ++-- > .../tools/marc_modification_templates.tt | 4 ++-- > .../prog/en/modules/tools/modborrowers.tt | 2 +- > .../prog/en/modules/tools/overduerules.tt | 2 +- > .../prog/en/modules/tools/picture-upload.tt | 2 +- > .../prog/en/modules/tools/problem-reports.tt | 2 +- > .../prog/en/modules/tools/quotes-upload.tt | 2 +- > .../prog/en/modules/tools/quotes.tt | 2 +- > .../prog/en/modules/tools/scheduler.tt | 2 +- > .../prog/en/modules/tools/showdiffmarc.tt | 4 ++-- > .../prog/en/modules/tools/stage-marc-import.tt | 4 ++-- > .../prog/en/modules/tools/stockrotation.tt | 4 ++-- > .../prog/en/modules/tools/upload-images.tt | 4 ++-- > .../prog/en/modules/tools/upload.tt | 4 ++-- > .../prog/en/modules/tools/viewlog.tt | 4 ++-- > .../virtualshelves/addbybiblionumber.tt | 2 +- > .../prog/en/modules/virtualshelves/shelves.tt | 8 ++++---- > .../bootstrap/en/includes/calendar.inc | 4 ++-- > .../bootstrap/en/includes/doc-head-close.inc | 8 ++++---- > .../bootstrap/en/includes/greybox.inc | 2 +- > .../includes/ill/backends/Standard/create.inc | 2 +- > .../backends/Standard/shared/custom_fields.inc | 2 +- > .../bootstrap/en/includes/js-biblio-format.inc | 3 +-- > .../bootstrap/en/includes/js-date-format.inc | 4 ++-- > .../bootstrap/en/includes/opac-bottom.inc | 18 +++++++++--------- > .../bootstrap/en/includes/password_check.inc | 2 +- > .../bootstrap/en/includes/slip-print.inc | 2 +- > .../en/includes/validator-strings.inc | 2 +- > .../bootstrap/en/modules/clubs/clubs-tab.tt | 2 +- > .../bootstrap/en/modules/clubs/enroll.tt | 2 +- > .../bootstrap/en/modules/maintenance.tt | 2 +- > .../bootstrap/en/modules/opac-MARCdetail.tt | 2 +- > .../bootstrap/en/modules/opac-account.tt | 2 +- > .../en/modules/opac-addbybiblionumber.tt | 4 ++-- > .../bootstrap/en/modules/opac-advsearch.tt | 4 ++-- > .../en/modules/opac-alert-subscriptions.tt | 2 +- > .../en/modules/opac-auth-MARCdetail.tt | 2 +- > .../bootstrap/en/modules/opac-auth-detail.tt | 2 +- > .../bootstrap/en/modules/opac-auth.tt | 2 +- > .../opac-authoritiessearchresultlist.tt | 2 +- > .../bootstrap/en/modules/opac-basket.tt | 4 ++-- > .../en/modules/opac-course-details.tt | 2 +- > .../en/modules/opac-course-reserves.tt | 2 +- > .../en/modules/opac-curbside-pickups.tt | 8 ++++---- > .../bootstrap/en/modules/opac-detail.tt | 6 +++--- > .../bootstrap/en/modules/opac-downloadshelf.tt | 4 ++-- > .../en/modules/opac-full-serial-issues.tt | 4 ++-- > .../bootstrap/en/modules/opac-holdshistory.tt | 4 ++-- > .../bootstrap/en/modules/opac-idref.tt | 4 ++-- > .../bootstrap/en/modules/opac-illrequests.tt | 4 ++-- > .../bootstrap/en/modules/opac-imageviewer.tt | 4 ++-- > .../bootstrap/en/modules/opac-library.tt | 2 +- > .../bootstrap/en/modules/opac-memberentry.tt | 2 +- > .../bootstrap/en/modules/opac-messaging.tt | 2 +- > .../en/modules/opac-overdrive-search.tt | 2 +- > .../bootstrap/en/modules/opac-passwd.tt | 2 +- > .../en/modules/opac-password-recovery.tt | 2 +- > .../en/modules/opac-patron-consent.tt | 2 +- > .../bootstrap/en/modules/opac-readingrecord.tt | 2 +- > .../bootstrap/en/modules/opac-recall.tt | 2 +- > .../bootstrap/en/modules/opac-recalls.tt | 2 +- > .../en/modules/opac-request-article.tt | 2 +- > .../bootstrap/en/modules/opac-reserve.tt | 2 +- > .../en/modules/opac-reset-password.tt | 2 +- > .../bootstrap/en/modules/opac-results.tt | 4 ++-- > .../bootstrap/en/modules/opac-review.tt | 2 +- > .../en/modules/opac-search-history.tt | 2 +- > .../bootstrap/en/modules/opac-serial-issues.tt | 2 +- > .../bootstrap/en/modules/opac-shareshelf.tt | 2 +- > .../bootstrap/en/modules/opac-shelves.tt | 4 ++-- > .../bootstrap/en/modules/opac-showreviews.tt | 2 +- > .../bootstrap/en/modules/opac-suggestions.tt | 2 +- > .../bootstrap/en/modules/opac-tags.tt | 6 +++--- > .../bootstrap/en/modules/opac-topissues.tt | 4 ++-- > .../bootstrap/en/modules/opac-user.tt | 4 ++-- > .../bootstrap/en/modules/sci/sci-main.tt | 12 ++++++------ > .../opac-tmpl/bootstrap/en/modules/sco/help.tt | 10 +++++----- > .../bootstrap/en/modules/sco/printslip.tt | 2 +- > .../bootstrap/en/modules/sco/sco-main.tt | 12 ++++++------ > 456 files changed, 710 insertions(+), 713 deletions(-) > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/batch_biblio_record_modification.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/batch_biblio_record_modification.inc >index b99adbc5051..0d9ac6e43c6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/batch_biblio_record_modification.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/batch_biblio_record_modification.inc >@@ -50,7 +50,7 @@ > [% END %] > > [% BLOCK js %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#add_bibs_to_list").change(function(){ > var selected = $("#add_bibs_to_list").find("option:selected"); > if ( selected.attr("class") == "shelf" ){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/erm_sushi_harvester.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/erm_sushi_harvester.inc >index 6592937aaf5..e3ed519d044 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/erm_sushi_harvester.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/erm_sushi_harvester.inc >@@ -108,7 +108,7 @@ > [% BLOCK js %] > [% INCLUDE 'str/job_progress.inc' job_id=job.id %] > [% INCLUDE 'str/erm_sushi_harvester.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > let job_id = [% job.id | $raw %]; > updateProgress(job_id, { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/import_from_kbart_file.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/import_from_kbart_file.inc >index a4ac5d7451e..7cd0ad20c73 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/import_from_kbart_file.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/background_jobs/import_from_kbart_file.inc >@@ -71,7 +71,7 @@ > [% BLOCK js %] > [% INCLUDE 'str/job_progress.inc' job_id=job.id %] > [% INCLUDE 'str/import_from_kbart_file.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > let job_id = [% job.id | html %]; > updateProgress(job_id, { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/calendar.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/calendar.inc >index 607d72d929b..8082107bd5d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/calendar.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/calendar.inc >@@ -3,7 +3,7 @@ > [% USE raw %] > <!-- calendar.inc --> > [% FILTER collapse %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var debug = "[% debug | html %]"; > var dateformat_pref = "[% Koha.Preference('dateformat') | html %]"; > var flatpickr_dateformat_string = ""; >@@ -42,7 +42,7 @@ > [% Asset.js("lib/flatpickr/shortcut-buttons-flatpickr.min.js") | $raw %] > [% Asset.js("lib/maskito/maskito.core.js") | $raw %] > [% Asset.js("lib/maskito/maskito.kit.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > flatpickr.l10ns.default.weekdays = flatpickr_weekdays; > flatpickr.l10ns.default.months = flatpickr_months; > flatpickr.l10ns.default.rangeSeparator = flatpickr_rangeSeparator; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc >index 9814cc375d0..77c715acd2c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/catalog-strings.inc >@@ -1,5 +1,5 @@ > <!-- catalog-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > /* Some required variables from the template */ > var biblionumber = "[% biblionumber | html %]"; > var count = [% count || 0 | html %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >index 1d0891c1858..3b5dcbab90a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-ui.inc >@@ -9,7 +9,7 @@ > [% Asset.js("lib/koha/cateditor/marc-mode.js") | $raw %] > [% Asset.js("lib/require.js") | $raw %] > <!-- cateditor-ui.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% FOREACH shortcut IN shortcuts -%] > var [% shortcut.shortcut_name | html %] = "[% shortcut.shortcut_keys | html %]"; > [% END %] >@@ -35,11 +35,11 @@ > [% IF marcflavour == 'MARC21' %] > [% PROCESS 'cateditor-widgets-marc21.inc' %] > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var editorWidgets = {}; > </script> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > require( [ 'koha-backend', 'search', 'macros', 'marc-editor', 'marc-record', 'preferences', 'resources', 'text-marc', 'widget' ], function( KohaBackend, Search, Macros, MARCEditor, MARC, Preferences, Resources, TextMARC, Widget ) { > var z3950Servers = [ > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-widgets-marc21.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-widgets-marc21.inc >index a8750b0bed0..7f1f6d76470 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-widgets-marc21.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/cateditor-widgets-marc21.inc >@@ -76,7 +76,7 @@ > </div> > </div> > <!-- cateditor-widgets-marc21.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > /** > * Each widget should provide one to three methods: > * init( text ): Returns the DOM node for this widget. >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >index 44d74f97e52..3f2b44676f9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/doc-head-close.inc >@@ -10,7 +10,7 @@ > [% IF logged_in_user %]<meta name="generator" content="Koha [% Koha.Version.maintenance | html %]" />[% END %] > [%# Prevent XFS attacks -%] > [% UNLESS popup %] >- <style id="antiClickjack"> >+ <style nonce="[% Koha.CSPNonce | $raw %]" id="antiClickjack"> > body { > display: none !important; > } >@@ -30,11 +30,11 @@ > [% Asset.css("lib/datatables/datatables.min.css") | $raw %] > [% Asset.css("css/print.css", { media = "print" }) | $raw %] > [% INCLUDE intranetstylesheet.inc %] >-<script type="module"> >+<script nonce="[% Koha.CSPNonce | $raw %]" type="module"> > import { APIClient } from "/intranet-tmpl/prog/js/fetch/api-client.js"; > window.APIClient = APIClient; > </script> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > [% IF CAN_user_parameters_manage_column_config %] > var CAN_user_parameters_manage_column_config = 1; >@@ -55,7 +55,7 @@ > > [% IF ( IntranetUserCSS ) %] > <!-- prettier-ignore-start --> >- <style>[% IntranetUserCSS | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% IntranetUserCSS | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc >index d58325a3118..b739f8ac4cf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/format_price.inc >@@ -1,6 +1,6 @@ > [% USE Koha %] > <!-- format-price.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [%# This should use the Format template plugin, but not pushed yet %] > [% IF Koha.Preference("CurrencyFormat") == 'FR' %] > var default_value = { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >index 9a1a3eaf65c..41397e2f3ff 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/html_helpers/tables/items/catalogue_detail.inc >@@ -93,7 +93,7 @@ > [% END %][%# end of block items_table %] > > [% BLOCK build_items_table_js %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let hide_patron_name = [% IF Koha.Preference('HidePatronName') %]true[% ELSE %]false[% END %]; > > let items_selection = {}; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-modal-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-modal-strings.inc >index 3440c78c325..b718f2e34f0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-modal-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-modal-strings.inc >@@ -1,5 +1,5 @@ > <!-- ill-batch-table-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var ill_batch_add = _("Add new batch"); > var ill_batch_update = _("Update batch"); > var ill_batch_none = _("None"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-table-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-table-strings.inc >index 2a8d4051e5e..8f162a447d8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-table-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-batch-table-strings.inc >@@ -1,5 +1,5 @@ > <!-- ill-batch-table-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var ill_batch_borrower_details = _("View borrower details"); > var ill_batch_edit = _("Edit"); > var ill_batch_delete = _("Delete"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-list-table-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-list-table-strings.inc >index 7a7989b3311..296b1fab51e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill-list-table-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill-list-table-strings.inc >@@ -1,5 +1,5 @@ > <!-- ill-list-table-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var ill_borrower_details = _("View patron details"); > var ill_manage = _("Manage request"); > var ill_manage_select_backend_first = _("Select a backend first"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc >index bb02161d3bd..19b7209b1a6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/create.inc >@@ -115,7 +115,7 @@ > <input type="hidden" name="op" value="cud-create" /> > </form> > [% BLOCK backend_jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // <![CDATA[] > var core = [ [% whole.core | $raw %] ]; > [% INCLUDE "ill/backends/Standard/shared/shared.js" %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/edititem.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/edititem.inc >index c7b4edba04d..ec4398851a8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/edititem.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/edititem.inc >@@ -83,7 +83,7 @@ > <input type="hidden" name="backend" value="Standard" /> > </form> > [% BLOCK backend_jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var core = [ [% whole.core | $raw %] ]; > // <![CDATA[] > [% INCLUDE "ill/backends/Standard/shared/shared.js" %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc >index 1e7e35666c6..7211077b1d2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/migrate.inc >@@ -108,7 +108,7 @@ > <input type="hidden" name="op" value="cud-migrate" /> > </form> > [% BLOCK backend_jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var core = [ [% whole.core | $raw %] ]; > // <![CDATA[] > [% INCLUDE "ill/backends/Standard/shared/shared.js" %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/shared/custom_fields.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/shared/custom_fields.inc >index e49b3832632..bfdc09d97d7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/shared/custom_fields.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/ill/backends/Standard/shared/custom_fields.inc >@@ -25,7 +25,7 @@ > </button> > </fieldset> > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .custom-field-input { > width: 25%; > display: inline-block; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc >index 0a3cec07946..a3203372c3b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-doc-head-close.inc >@@ -10,7 +10,7 @@ > [% ELSE %] > [% Asset.css("css/installer.css") | $raw %] > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > </script> > [% IF lang && lang != 'en' %] >@@ -19,7 +19,7 @@ > [% Asset.js('js/Gettext.js') | $raw %] > [% Asset.js('js/i18n.js') | $raw %] > [% Asset.js('js/stores.js') | $raw %] >-<style id="antiClickjack"> >+<style nonce="[% Koha.CSPNonce | $raw %]" id="antiClickjack"> > body { > display: none !important; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc >index 382f64ef5b1..8dfbfdabf28 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-intranet-bottom.inc >@@ -6,7 +6,7 @@ > [% Asset.js("lib/bootstrap/bootstrap.bundle.min.js") | $raw %] > [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] > <!-- installer-intranet-bottom.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function _(s) { return s } // dummy function for gettext > [%# Prevent XFS attacks -%] > $(document).ready(function() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-strings.inc >index 0b5537b88ea..36869450726 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/installer-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/installer-strings.inc >@@ -1,5 +1,5 @@ > <!-- installer-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_LETTERS_ONLY = _("Please only enter letters."); > var MSG_PASSWORD_MISMATCH = _("The entered passwords do not match"); > var MSG_ONE_ENROLLMENTPERIOD = _("Please choose an enrollment period in months OR by date."); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc >index 0ce745868b3..ad8ee4aab41 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/intranet-bottom.inc >@@ -187,7 +187,7 @@ > [% END %] > > [% IF Koha.debug_flag %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > (function () { > function getURLParams() { > const params = new URLSearchParams(window.location.search); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js-biblio-format.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js-biblio-format.inc >index e3cbd9c8507..4e67809de89 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js-biblio-format.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js-biblio-format.inc >@@ -1,5 +1,4 @@ >- >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function () { > /** > * Format the biblio response from a Koha RESTful API request. >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js-date-format.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js-date-format.inc >index 029fa91862d..39a5b68882e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js-date-format.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js-date-format.inc >@@ -6,13 +6,13 @@ > [% Asset.js("lib/dayjs/plugin/utc.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/timezone.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/customParseFormat.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_utc); > dayjs.extend(window.dayjs_plugin_timezone); > dayjs.extend(window.dayjs_plugin_customParseFormat); > </script> > <!-- js-date-format.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function() { > var def_date_format = '[% Koha.Preference('dateformat') | html %]'; > var def_time_format = '[% Koha.Preference('TimeFormat') | html %]'; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-format-address.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-format-address.inc >index daa979717e8..66f16c2aa1f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-format-address.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-format-address.inc >@@ -2,7 +2,7 @@ > [% USE raw %] > [% USE To %] > [% USE AuthorisedValues %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function() { > > const roadtypes = [% To.json(AuthorisedValues.Get('ROADTYPE')) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-get-age.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-get-age.inc >index 25d824490c0..d6b39c535ce 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-get-age.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js-patron-get-age.inc >@@ -1,6 +1,6 @@ > <!-- js-patron-get-age.inc --> > [% USE KohaDates %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function() { > > const tz = '[% KohaDates.tz | html %]'; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >index 189a2687c9c..1d36e7e8aae 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/js_includes.inc >@@ -6,7 +6,7 @@ > [% USE Koha %] > [%# Prevent XFS attacks -%] > [% UNLESS popup %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > if (self === top) { > var antiClickjack = document.getElementById("antiClickjack"); > antiClickjack.parentNode.removeChild(antiClickjack); >@@ -35,7 +35,7 @@ > [% INCLUDE 'validator-strings.inc' %] > [% IF ( IntranetUserJS ) %] > <!-- js_includes.inc: IntranetUserJS --> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IntranetUserJS | $raw %] > </script> > <!-- / js_includes.inc: IntranetUserJS --> >@@ -51,7 +51,7 @@ > [% END %] > > [% IF Koha.Preference('AudioAlerts') || AudioAlertsPage %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // AudioAlerts > var AUDIO_ALERT_PATH = '[% interface | html %]/[% theme | html %]/sound/'; > var AUDIO_ALERTS = JSON.parse( "[% To.json(AudioAlerts.AudioAlerts) | $raw %]" ); >@@ -69,7 +69,7 @@ > }); > </script> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var defaultPatronSearchFields = "[% Koha.Preference('DefaultPatronSearchFields') || 'firstname|preferred_name|middle_name|surname|othernames|cardnumber|userid' | html %]"; > var defaultPatronSearchMethod = "[% Koha.Preference('DefaultPatronSearchMethod') || 'contains' | html %]"; > var extendedPatronAttributes = "[% Koha.Preference('ExtendedPatronAttributes') | html %]"; >@@ -78,7 +78,7 @@ > var showPatronFirstnameIfDifferentThanPreferredname = [% Koha.Preference('ShowPatronFirstnameIfDifferentThanPreferredname') ? 1 : 0 | html %]; > </script> > [% IF ( PatronAutoComplete ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // PatronAutoComplete > var loggedInClass = ""; > $(document).ready(function(){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/last-borrower.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/last-borrower.inc >index 6a418993566..f4639f9a149 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/last-borrower.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/last-borrower.inc >@@ -1,5 +1,4 @@ >- >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var showLastPatronCount = "[% Koha.Preference('showLastPatronCount') | html %]"; > </script> > <div id="lastborrower-window"> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc >index fc5b1da4a4e..18265cc46d0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/main-container.inc >@@ -85,7 +85,7 @@ > </div> > [% SET islands = Asset.js("js/vue/dist/islands.esm.js").match('(src="([^"]+)")').1 %] <script src="[% islands | $raw %]" type="module"> > </script> >-<script type="module"> >+<script nonce="[% Koha.CSPNonce | $raw %]" type="module"> > import { hydrate } from "[% islands | $raw %]"; > hydrate(); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/messaging-preference-form.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/messaging-preference-form.inc >index b3b8ad69f95..f652644bc3c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/messaging-preference-form.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/messaging-preference-form.inc >@@ -337,7 +337,7 @@ > [% END %] > </tbody> > </table> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.addEventListener("DOMContentLoaded", function () { > const selectElement = document.querySelector('select[name="2-DAYS"]'); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc >index 31d78115288..f7954be5cdd 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/modal-claims.inc >@@ -46,7 +46,7 @@ > [% END %] > > [% BLOCK 'modal-claims-js' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // Verify if the syspref is defined > var ClaimReturnedLostValue = "[% Koha.Preference('ClaimReturnedLostValue') | html %]"; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc >index 2960da66eec..106d39d55e1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/password_check.inc >@@ -1,6 +1,6 @@ > [% USE Koha %] > <!-- password_check.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var pwd_title = ""; > var pattern_title = ""; > var new_password_node_name = "[% new_password | html %]"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >index 859d439c5fd..296a20368a9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/patron-search.inc >@@ -231,11 +231,11 @@ > [% BLOCK patron_search_js %] > > [% IF redirect_if_one_result && !redirect_url %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > console.log("Wrong call of patron_search_js - missing redirect_url"); > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var categories = [% To.json(Categories.all.unblessed) | $raw %].map(e => { > e['_id'] = e.categorycode.toLowerCase(); > e['_str'] = e.description; >@@ -302,7 +302,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-patron-get-age.inc' %] > [% INCLUDE 'js-patron-format-address.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > { > > function get_patron_search_form(){ >@@ -1036,7 +1036,7 @@ > </div> > </div> > <div id="patron_preview_modal" class="basicModal"></div> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > let parent_block = $("#[% search_results_block_id | html %]"); > parent_block.find(".select_all").on("click",function(e){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/slip-print.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/slip-print.inc >index 4a39a40a1d2..ea785090e06 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/slip-print.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/slip-print.inc >@@ -1,6 +1,6 @@ > [% USE raw %] > <!-- slip-print.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF ( Koha.Preference('IntranetSlipPrinterJS') ) %] > let autoprint = false; > [% Koha.Preference('IntranetSlipPrinterJS') | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/cataloging_additem.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/cataloging_additem.inc >index 1a2009d6f13..c7071de4741 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/cataloging_additem.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/cataloging_additem.inc >@@ -1,6 +1,6 @@ > [% USE raw %] > <!-- str/cataloging_additem.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var searchid = '[% searchid | html %]'; > var biblionumber = '[% biblionumber | html %]'; > var frameworkcode = '[% frameworkcode | html %]'; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc >index 8d6db835244..ca3e43b43d4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/erm_sushi_harvester.inc >@@ -1,5 +1,5 @@ > <!-- str/job_progress.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var REQUESTING_SUSHI = _("Requesting SUSHI service"); > var CREATING_COUNTER = _("Creating COUNTER file and processing data"); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc >index 08626ea6cae..0dc59437e6c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/import_from_kbart_file.inc >@@ -1,5 +1,5 @@ > <!-- str/job_progress.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var READING_FILE = _("Reading file"); > var PROCESSING_FILE = _("Processing file and importing titles"); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc >index 678ed1f6bce..f604e631604 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/job_progress.inc >@@ -1,5 +1,5 @@ > <!-- str/job_progress.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var JOB_PROGRESS_NOT_STARTED = _("Not started"); > var JOB_PROGRESS_STARTED = _("Started"); > var JOB_PROGRESS_FINISHED = _("Finished"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/members-menu.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/members-menu.inc >index 530e9bfb89a..7c77f4da654 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/members-menu.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/members-menu.inc >@@ -6,7 +6,7 @@ > [% IF ( Koha.Preference('patronimages') ) %] > [% Asset.js("js/patron-webcam.js") | $raw %] > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var advsearch = "[% advsearch | html %]"; > var destination = "[% destination | html %]"; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc >index 7efafd727d5..60fb2fe1bc4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/str/tinymce_i18n.inc >@@ -1,5 +1,5 @@ > <!-- str/tinymce_i18n.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > /* tinymce considers 'en' to be the default translation. > Translating this file will allow us to load the correct language > along with the template */ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/validator-strings.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/validator-strings.inc >index dbd32806e57..90264d622ba 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/validator-strings.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/validator-strings.inc >@@ -1,5 +1,5 @@ > <!-- validator-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > jQuery.extend(jQuery.validator.messages, { > required: _("This field is required."), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/wysiwyg-systempreferences.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/wysiwyg-systempreferences.inc >index 3ec09b2845b..b28a897b1b1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/wysiwyg-systempreferences.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/wysiwyg-systempreferences.inc >@@ -4,7 +4,7 @@ > [% Asset.js("lib/tiny_mce/tinymce.min.js") | $raw %] > [% INCLUDE 'str/tinymce_i18n.inc' %] > <!-- wysiwyg-systempreferences.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > // Save TinyMCE content and trigger an event on the original element > function wysiwyg_change (ed){ > ed.save(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950_search.inc b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950_search.inc >index 56d262d5db2..bc58a8a7580 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/includes/z3950_search.inc >+++ b/koha-tmpl/intranet-tmpl/prog/en/includes/z3950_search.inc >@@ -1,5 +1,5 @@ > <!-- z3950_search.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var interface = "[% interface | html %]"; > var theme = "[% theme | html %]"; > var total_pages = new Number("[% total_pages | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >index 326eae4175f..1225b83e9a5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/about.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .version-ellipsis { > text-decoration: underline; > } >@@ -93,7 +93,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > let perl_table = $("#perl_table").kohaTable({ > autoWidth: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt >index ce1aeb308a0..89849aa81f3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/acqui-home.tt >@@ -207,10 +207,10 @@ > [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% IF loop_budget %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'acqui', 'acq_acqui-home', 'accounts', 'json' ) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dt_overwrite_html_sorting_localeCompare(); > > $(document).ready(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt >index e45dff7e183..b143d481ec8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/addorderiso2709.tt >@@ -17,7 +17,7 @@ > [% END %]</title > > > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .biblio { > padding: 0 0.5em; > margin: 0; >@@ -45,7 +45,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/addbiblio.css") | $raw %] > [%# As long as cataloging plugins rely on 'script' tags added inline, JS must be in the header %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > const template_path = "[% interface | html %]/[% theme | html %]"; > </script> > [% Asset.js("js/acquisitions-menu.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >index 163fa5f323e..9774ec8ae08 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basket.tt >@@ -33,7 +33,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sortmsg { > font-size: 80%; > } >@@ -1276,7 +1276,7 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/acq.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function updateColumnsVisibility(visible) { > if ( visible ) { > $("table .tax_excluded, .tax_included").show(); >@@ -1364,7 +1364,7 @@ > }); > </script> > [% UNLESS ( closedate ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function transfer_order_popup(ordernumber) { > var url = "/cgi-bin/koha/acqui/transferorder.pl?" > + "ordernumber=" + ordernumber >@@ -1393,7 +1393,7 @@ > }); > </script> > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $("#basketgroupid").change(function(){ > if($(this).val() == "new"){ >@@ -1405,7 +1405,7 @@ > }); > </script> > [% END # /UNLESS (closedate) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var orders_table_settings = [% TablesSettings.GetTableSettings( 'acqui', 'basket', 'orders', 'json' ) | $raw %]; > let supplier_report_column = orders_table_settings.columns.find(c => c.columnname == 'supplier_report'); > [% IF !(Koha.Preference('EDIFACT') && ediaccount) %] >@@ -1434,7 +1434,7 @@ > > let skip_confirm_reopen = [% skip_confirm_reopen ? 1 : 0 | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#orders").kohaTable( > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt >index 69e0f5eeda4..2eb1a220b91 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketgroup.tt >@@ -396,11 +396,11 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let listclosed = [% listclosed ? 1 : 0 | html %]; > let grouping = [% grouping ? 1 : 0 | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function submitForm(form) { > if (form.closedbg.checked == true) { > var input = document.createElement("input"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt >index e50b1e89473..359f72633cf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/basketheader.tt >@@ -174,7 +174,7 @@ > [% Asset.js("js/acq.js") | $raw %] > [% Asset.js("js/additional-fields-entry.js") | $raw %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > function display_vendor(vendor) { > var $text; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >index 5b47155eab4..19977c5a41a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/booksellers.tt >@@ -14,7 +14,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #vendors td { > vertical-align: top; > } >@@ -232,7 +232,7 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/acq.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("table.baskets").kohaTable({ > dom: "t", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt >index 357d5194a29..43f8a7f651e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/duplicate_orders.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .picked_to_duplicate > td { > background-color: #bcdb89 !important; > } >@@ -314,11 +314,11 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/acq.js") | $raw %] > [% Asset.js("js/funds_sorts.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const op = "[% op | html %]"; > const has_results = [% result_order_loop ? 1 : 0 | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function update_ordernumber_list() { > var ordernumbers = []; > $("input[name='ordernumber']") >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edifactmsgs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edifactmsgs.tt >index eb2ae3a82f4..bd742868fb9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edifactmsgs.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/edifactmsgs.tt >@@ -44,7 +44,7 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/modals/edifact-modal.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > let edi_msgs_table_url = "/api/v1/acquisitions/edifiles?"; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt >index cf297531850..fa552e4f2c3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/histsearch.tt >@@ -167,10 +167,10 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'acqui', 'histsearch', 'histsearcht', 'json' ) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#histsearcht").kohaTable( > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >index aeb50dbc9dd..2b335bbe5c1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice-files.tt >@@ -115,7 +115,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#invoice_files_details_table").kohaTable({ > columnDefs: [{ targets: [-1, -2], orderable: false, searchable: false }], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >index ae09cbc0a6f..0db65f5cd3e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoice.tt >@@ -576,14 +576,14 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/modals/edifact-modal.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > addPrefs({ > AcqEnableFiles: [% Koha.Preference('AcqEnableFiles') ? 1 : 0 | html %], > }); > const invoiceincgst = [% invoiceincgst ? 1 : 0 | html %]; > const has_files = [% files ? 1 : 0 | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function updateColumnsVisibility(visible) { > if (visible) { > $("table .tax_excluded, .tax_included").show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt >index b931741d4fb..1ccefdb5095 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/invoices.tt >@@ -478,7 +478,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'select2.inc' %] > [% INCLUDE 'js-date-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $('[id^="CheckAll"]').click(function () { > var table_id = "#" + $(this).attr("data-cb") + "resultst"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt >index a9cea3112aa..7b842696a60 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/lateorders.tt >@@ -374,10 +374,10 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'acqui', 'lateorders', 'late_orders', 'json' ) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var late_orderst; > function check_uncheck() { > var all_nodes = late_orderst.DataTable().rows().nodes(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >index 782f0dc2d94..ddea9157d16 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/neworderempty.tt >@@ -21,7 +21,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #itemfieldset label, > #itemfieldset span.label { > flex-basis: 25%; >@@ -54,7 +54,7 @@ > [% Asset.js("js/additional-fields-entry.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'select2.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > actTotal = ""; > > function Check(ff) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersubscription.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersubscription.tt >index a7b4b57b7c2..7b588510484 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersubscription.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersubscription.tt >@@ -114,7 +114,7 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function updateRowsVisibility(show_only_renewed) { > if (show_only_renewed) { > $("#srlt [data-reneweddate='']").hide(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >index f6eabe7d5b6..0497ce08a9d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/newordersuggestion.tt >@@ -131,10 +131,10 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] > [% IF suggestions.size %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const logged_in_user = [% To.json(logged_in_user.unblessed) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var suggestionst = $("#suggestionst").kohaTable({ > columnDefs: [ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ordered.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ordered.tt >index 2e4fc530963..36b4c6fa910 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ordered.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/ordered.tt >@@ -118,7 +118,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#spent").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt >index ce3e5b400a7..a4dcb687ba2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/orderreceive.tt >@@ -20,7 +20,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > @media (min-width: 1200px) { > #receive-modal, > #receive-modal { >@@ -453,7 +453,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% INCLUDE 'format_price.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var edit_mode = "[% edit | html %]"; > var invoiceincgst = "[% invoiceincgst | html %]"; > var active_currency = "[% active_currency.currency | html %]"; >@@ -468,7 +468,7 @@ > CAN_user_acquisition: [% CAN_user_acquisition ? 1 : 0 | html %], > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function display_string(key, strings, fallback) { > if (strings.hasOwnProperty(key)) { > return (strings[key].str && escape_str(strings[key].str)) || ""; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >index e1aaff96097..73c140a3fba 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcel.tt >@@ -350,12 +350,12 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.action { > margin-bottom: 20px; > } > </style> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > addPrefs({ > marcflavour: "[% Koha.Preference('marcflavour') | html %]", > }); >@@ -374,7 +374,7 @@ > order: "[%tp("noun", "Order") | html %]", > }; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dt_overwrite_html_sorting_localeCompare(); > var PENDING_MULTI_SELECTION = _("Receive selected (%s)"); > var columns_filter = {}; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt >index 4170bf903ce..bc5c3e9bc4d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/parcels.tt >@@ -269,7 +269,7 @@ > [% Asset.js("js/additional-fields-entry.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#parcelst").kohaTable({ > paging: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/spent.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/spent.tt >index 84ec2f98b13..8a9d6ee579f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/spent.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/spent.tt >@@ -128,7 +128,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#spent").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt >index 6166b137a55..f49e96ba3fc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/transferorder.tt >@@ -170,14 +170,14 @@ > > [% MACRO jsinclude BLOCK %] > [% IF transferred %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > opener.location.reload(); > window.close(); > </script> > [% END %] > > [% IF ( bookselleridfrom ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".confirm_transfer").on("click", function () { > return confirm(_("Transfer order to this basket?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt >index abdb566a100..6380d8739d3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/uncertainprice.tt >@@ -189,7 +189,7 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% Asset.js("js/acq.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var uncertainpricet = $("#uncertainpricet").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt >index 6288db3af1a..c98ef928445 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendor_issues.tt >@@ -210,10 +210,10 @@ > [% Asset.js("js/acquisitions-menu.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const vendor_id = [% vendor.id | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var issues_table_url = `/api/v1/acquisitions/vendors/${vendor_id}/issues?`; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendors.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendors.tt >index ef2d381c425..914bb04c96d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendors.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/vendors.tt >@@ -28,7 +28,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% INCLUDE 'format_price.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const vendorTableSettings = [% TablesSettings.GetTableSettings( 'acqui', 'vendors', 'vendors', 'json' ) | $raw %]; > </script> > [% Asset.js("js/vue/dist/acquisitions.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt >index 723f8adfc5a..329ab09ee3a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/acqui/z3950_search.tt >@@ -20,7 +20,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% USE Koha %] > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > tr.selected { > background-color: #ffffcc; > } >@@ -332,7 +332,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'z3950_search.inc' %] > [% Asset.js("js/z3950_search.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var resultst = $("#resultst").kohaTable({ > columnDefs: [{ targets: [1], type: "nsb-nse" }], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt >index 294cc25a0e4..766f01c5302 100755 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/additional-fields.tt >@@ -315,7 +315,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE "datatables.inc" %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#selecttable").find(":submit").hide(); > $("#selecttable select").change(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt >index 6bf1da18ac4..695dd90eb17 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgetperiods.tt >@@ -563,10 +563,10 @@ > [% Asset.js("js/acq.js") | $raw %] > > [% IF close_form %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const budget_period_description = "[% budget_period_description | html %]"; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#budgeth").kohaTable({ > dom: "t", >@@ -583,7 +583,7 @@ > [% END %] > > [% IF closed %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var oTable = $("#closed_report").kohaTable({ > // The following is a c/p from aqbudgets.tt and is a candidate for refactoring. >@@ -622,7 +622,7 @@ > }); > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > let dt_params = { > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >index 9e5af86256c..a8e4eecee28 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqbudgets.tt >@@ -528,7 +528,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acq.js") | $raw %] > [% IF op == 'add_form' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > //<![CDATA[ > > function select_user(borrowernumber, borrower) { >@@ -677,10 +677,10 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %] > [% IF budgets %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const budget_period_id = [% budget_period_id || 'null' | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var oTable = $("#budgeth").kohaTable({ > drawCallback: function (oSettings) { >@@ -749,7 +749,7 @@ > }); > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".deletefund-disabled").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt >index 1743ad819cc..9ba4078beec 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqcontract.tt >@@ -202,7 +202,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% Asset.js("js/acq.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#add_modify_contract").validate({ > rules: { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt >index 1294b241aaf..92fb64c1c98 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/aqplan.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > td.locked { > background-image: url("[% interface | html %]/[% theme | html %]/img/locked.png"); > padding-left: 20px; >@@ -320,7 +320,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/acq.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > jQuery.validator.addClassRules({ plan_entry: { pnumber: true } }); // require that input be a number in fields with the class 'plan_entry' > jQuery.validator.addMethod("pnumber", $.validator.methods.number, _("Please enter a valid number.") ); > var zero_formatted = "[% 0 | $Price on_editing => 1 %]"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt >index 18a88a77bd6..5562e00101e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_subfields_structure.tt >@@ -435,10 +435,10 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const tagsubfield = [% IF tagsubfield %]"[% tagsubfield | html %]"[% ELSE %]null[% END %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#table_authsubfieldstructure").kohaTable({ > order: [], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt >index f38c4760268..a01b4f92c76 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/auth_tag_structure.tt >@@ -287,7 +287,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#table_authtagstructure").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt >index 7e9807e9abe..6c7efef59da 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/authorised_values.tt >@@ -35,7 +35,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows div.toptabs li { > clear: none; > margin-right: 0.4em; >@@ -403,7 +403,7 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#categoriest").kohaTable({ > order: [[0, "asc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/background_jobs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/background_jobs.tt >index eccc21bb977..edca3b1bce1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/background_jobs.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/background_jobs.tt >@@ -144,7 +144,7 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'js-date-format.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const job_statuses = [ > {'_id': 'new', '_str': _("New")}, > {'_id': 'cancelled', '_str': _("Cancelled")}, >@@ -244,7 +244,7 @@ > type: "[% job.type | html %]", > }; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function get_job_type(job_type) { > let job_type_lib = job_types.find(t => t._id == job_type); > if (job_type_lib) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt >index b4a85fe0217..11587490c73 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/biblio_framework.tt >@@ -452,7 +452,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var template_path = "[% interface | html %]/[% theme | html %]"; > </script> > [% Asset.js("js/biblio_framework.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt >index 35cc0d7d2c3..b4f9c72d5a3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branch_transfer_limits.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > td { > text-align: center; > } >@@ -135,10 +135,10 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const codes_loop = [% To.json(codes_loop) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#CheckAll").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt >index b82d59d5790..e9d7ffe0d60 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/branches.tt >@@ -30,7 +30,7 @@ > [% Asset.css("lib/codemirror/codemirror.min.css") | $raw %] > [% Asset.css("lib/codemirror/lint.min.css") | $raw %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .opac-library-info { > border: 1px solid #dedede; > border-radius: 2px; >@@ -809,7 +809,7 @@ > [% Asset.js( "lib/codemirror/css-lint.min.js" ) | $raw %] > [% Asset.js( "lib/codemirror/yaml-lint.min.js" ) | $raw %] > [% Asset.css("lib/codemirror/codemirror.css") | $raw %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .CodeMirror { > border: 1px solid #eee; > margin: 1em, 1em, 1em, 0; >@@ -817,11 +817,11 @@ > width: 50em; > } > </style> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'admin', 'libraries', 'libraries', 'json' ) | $raw %]; > var calendarFirstDayOfWeek = '[% Koha.Preference('CalendarFirstDayOfWeek') | html %]'; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var libraries_table; > $(document).ready(function () { > var libraries_url = "/api/v1/libraries"; >@@ -1034,7 +1034,7 @@ > }); > </script> > [% UNLESS library %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#Aform").on("submit", function (event) { > if ($("#branchcode").val().match(/\s/)) { > event.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt >index 48b2b63cd1c..48d8ea05112 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cash_registers.tt >@@ -234,7 +234,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var crtable = $("#table_cash_registers").kohaTable({ > order: [[1, "asc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt >index c0a66967ffb..8fa494a01ad 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt >@@ -33,7 +33,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("lib/jquery/plugins/multiple-select/multiple-select.min.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #enrolmentmessage.hint { > display: none; > } >@@ -851,7 +851,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var TalkingTechItivaPhoneNotification = [% Koha.Preference('TalkingTechItivaPhoneNotification') || 0 | html %]; > var PhoneNotification = [% Koha.Preference('PhoneNotification') || 0 | html %]; > </script> >@@ -861,7 +861,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'admin', 'categories', 'patron_categories', 'json' ) | $raw %]; > </script> > [% Asset.js("js/categories.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt >index a8a47d0c21b..72cc4fa4716 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/cities.tt >@@ -204,7 +204,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'admin', 'cities', 'table_cities', 'json' ) | $raw %]; > var cities_table_url = '/api/v1/cities?'; > >@@ -217,7 +217,7 @@ > cities_table_url += 'q='+ encodeURIComponent(JSON.stringify(city_name_filter)); > [% END %] > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var cities_table = $("#table_cities").kohaTable( > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt >index 42fb22c6384..d9a3d793149 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/classsources.tt >@@ -33,7 +33,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #button_add, > .split_regex, > .split_callnumber { >@@ -437,7 +437,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function update_regex_block() { > if ($("#split_routine option:selected").val() == "RegEx") { > $("#regex_block").show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt >index 8c2ad17ebc2..c001cdca1e7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/columns_settings.tt >@@ -201,7 +201,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > caption { > font-size: 115%; > } >@@ -403,7 +403,7 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > > [%- IF ( panel.defined ) -%] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready( function() { > $("#[% panel | uri %]_panel").collapse("show"); > [%- IF page.defined -%] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt >index 7fb1068645d..c5c6af8db7b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/credit_types.tt >@@ -254,7 +254,7 @@ > [% Asset.js("js/additional-fields-entry.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var txtActivefilter = _("Filter system credit types"); > var txtInactivefilter = _("Show all credit types"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt >index 0633d5d8072..0b45ebac378 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/curbside_pickup.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .pickup-slot { > border: 2px solid #b9d8d9; > padding: 0 0.1em; >@@ -173,7 +173,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let opening_slots = {}; > let slots; > [% FOR l IN libraries %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt >index 18ce99e98ff..78b7ff2b8d5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/currency.tt >@@ -266,10 +266,10 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let table_settings = [% TablesSettings.GetTableSettings( 'admin', 'currency', 'currencies-table', 'json' ) | $raw %] > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function check_currency(val) { > if (val == 1.0) { > $("#active").prop("disabled", false); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt >index 018bd5c6654..eea87082e05 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/debit_types.tt >@@ -271,7 +271,7 @@ > [% Asset.js("js/additional-fields-entry.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var txtActivefilter = _("Filter system debit types"); > var txtInactivefilter = _("Show all debit types"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt >index 13a9c1c8bdf..beb311a2bc5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/desks.tt >@@ -206,7 +206,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#table_desks").kohaTable({ > order: [[1, "asc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt >index 6029daf70bb..cd8fa9359b0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/didyoumean.tt >@@ -79,7 +79,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".pluginlist").each((i, e) => { > Sortable.create(e, { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt >index 94a4838b95f..c002babf051 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/edi_accounts.tt >@@ -409,10 +409,10 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'admin', 'edi_accounts', 'edi_accounts_table', 'json' ) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#edi_accounts_table").kohaTable( > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/file_transports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/file_transports.tt >index 0ab7f2500cc..ad9de3cb8f5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/file_transports.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/file_transports.tt >@@ -459,12 +459,12 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > [% Asset.js("js/transport_status.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const i18n = { > on: "[% tp("Active", "On") | html %]" > }; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var file_transports_url = "/api/v1/config/file_transports"; > window.file_transports = $("#file_transports").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/float_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/float_limits.tt >index 9709c43ad08..34f6af907b1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/float_limits.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/float_limits.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .disabled-transfer { > background-color: #ff8888; > } >@@ -108,7 +108,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > jQuery.validator.addClassRules("float_limit", { > digits: true, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt >index bebc628994f..ded1c0d4019 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_provider_domains.tt >@@ -327,7 +327,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var identity_provider_domains_url = '/api/v1/auth/identity_providers/[%- identity_provider_id | html -%]/domains'; > [% SET categories = Categories.all() %] > var categories = { >@@ -344,7 +344,7 @@ > > const identity_provider_id = "[%- identity_provider_id | html -%]"; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > window.identity_provider_domains = $("#identity_provider_domains").kohaTable({ > ajax: { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt >index 0b488f5520c..609e1389363 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/identity_providers.tt >@@ -406,7 +406,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var identity_providers_url = "/api/v1/auth/identity_providers"; > window.identity_providers = $("#identity_providers").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt >index 63f4f790952..340031a36f3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/item_circulation_alerts.tt >@@ -13,7 +13,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > table.grid thead th { > vertical-align: bottom; > } >@@ -173,7 +173,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var $branch = "[% branch | html %]"; > $(function(){ > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt >index 2c503087ff0..c79afe4af6c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/itemtypes.tt >@@ -36,7 +36,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows div.toptabs li { > clear: none; > margin-right: 0.4em; >@@ -554,13 +554,13 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'admin', 'itemtypes', 'table_item_type', 'json' ) | $raw %]; > [% IF ( Koha.Preference('noItemTypeImages') && Koha.Preference('OpacNoItemTypeImages') ) %] > table_settings['columns'].shift(); // Remove item type image column from configuration > [% END %] > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#table_item_type").kohaTable( > { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt >index a42f47598e8..bf817f3ec81 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/koha2marclinks.tt >@@ -81,7 +81,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function AddFld(kohafield) { > var fieldstr = prompt( > _("Adding a mapping for: %s.").format(kohafield) + >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt >index 059b66b9b04..075aa216e52 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/library_groups.tt >@@ -305,7 +305,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".library-groups").treetable({ > expandable: true, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt >index 79b97a85678..eb593d31be9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/localization.tt >@@ -16,7 +16,7 @@ > [% END %] > </title> > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #localization { > margin-top: 1em; > } >@@ -141,7 +141,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function show_message(params) { > var type = params.type; > var data = params.data; >@@ -323,7 +323,7 @@ > }); > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var languages_select = $('<select name="lang" id="lang"></select>'); > [% FOR language IN languages %] > [% FOR sublanguage IN language.sublanguages_loop %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt >index cb01fc68c3f..ab5bfc3a6dc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc-overlay-rules.tt >@@ -15,7 +15,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #tag-error { > display: block; > margin-top: 5px; >@@ -318,10 +318,10 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var categories = [% To.json( categories ) | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var validator = $("#marc-overlay-rules-form").validate({ > ignore: ".ignore", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_order_accounts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_order_accounts.tt >index 53c4541a9b7..a5ca0e176f4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_order_accounts.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_order_accounts.tt >@@ -286,7 +286,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > function display_vendor(vendor) { > var $text; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt >index ea4a5907ae7..0a1849f37ea 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marc_subfields_structure.tt >@@ -31,7 +31,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .constraints::after { > content: " "; > clear: both; >@@ -438,7 +438,7 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var tagsubfield = "[% tagsubfield | html %]"; > </script> > [% Asset.js("js/marc_subfields_structure.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >index 12c7bb6fe8f..074e951b2db 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/marctagstructure.tt >@@ -330,7 +330,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#table_marctagstructure").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt >index 551b893c510..0eb1c5f6c96 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/matching-rules.tt >@@ -66,7 +66,7 @@ > </select> > [% END %] > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows fieldset.rows { > border-width: 0; > } >@@ -731,7 +731,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var maxMatchPoint = [% max_matchpoint | html %]; > var maxMatchCheck = [% max_matchcheck | html %]; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt >index 88d954ecdd6..8b95879647f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_servers.tt >@@ -185,7 +185,7 @@ > [% INCLUDE 'datatables.inc' %] > [% END %] > [% IF server %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const server = { > dataformat: "[% server.dataformat | html %]", > recordtype: "[% server.recordtype | html %]", >@@ -193,7 +193,7 @@ > </script> > [% END %] > [% IF op == 'edit_form' || op == 'add_form' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // Update selects for dataformat and recordtype > // FIXME Do not do this in JS! >@@ -221,7 +221,7 @@ > }); > </script> > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#serverst").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt >index b7fa61446d3..526247534bb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_set_mappings.tt >@@ -149,7 +149,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#mappingform").submit(function () { > hideDialogBox(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt >index 40de1123186..b99ecd0866a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/oai_sets.tt >@@ -164,7 +164,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function newDescField() { > $("#adddescription").before( > "<li><label>" + >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt >index 7fba47006ed..75c11c5e26d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/overdrive.tt >@@ -70,7 +70,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#od_info").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt >index 631a41867b8..cb4c9cf6fbb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/patron-attr-types.tt >@@ -407,7 +407,7 @@ > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const opac_display = document.getElementById("opac_display"); > const opac_editable = document.getElementById("opac_editable"); > const opac_mandatory = document.getElementById("opac_mandatory"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >index 312f70a78d0..d1bdc6ae89a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences.tt >@@ -301,7 +301,7 @@ > [% Asset.js( "lib/codemirror/css-lint.min.js" ) | $raw %] > [% Asset.js( "lib/codemirror/yaml-lint.min.js" ) | $raw %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var themelang = "[% themelang | html %]"; > $(document).ready(function(){ > $("select[multiple='multiple']").multipleSelect( { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt >index cf11b2c6d51..dddce019c51 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/restrictions.tt >@@ -236,7 +236,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_DUPLICATE_CODE = _("Restriction type code is already in use"); > var MSG_DUPLICATE_DISPLAY_TEXT = _("Restriction type label is already in use"); > var existing = { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >index 1aea30fc4ee..d54dd3eb997 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/search_filters.tt >@@ -85,7 +85,7 @@ > [% Asset.css("css/humanmsg.css") | $raw %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let filters_table; > $(document).ready(function () { > filters_table = $("#search_filters_table").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt >index 5ff1893f823..157aafad8c2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/searchengine/elasticsearch/mappings.tt >@@ -12,7 +12,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > a.add, > a.delete { > cursor: pointer; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt >index 0c165fc5b7a..4d00d77ca36 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/share_content.tt >@@ -155,7 +155,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#mana_token").submit(function () { > return confirm(_("This will delete the Mana KB token from Koha. Do you want to continue?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt >index f93ce5bfb7b..63148e9d137 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smart-rules.tt >@@ -1452,7 +1452,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'format_price.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#default-circulation-rules").kohaTable({ > columnDefs: [ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt >index bf4c1e371c9..aff2c2774bb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/smtp_servers.tt >@@ -319,12 +319,12 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const i18n = { > on: "[% tp("Active", "On") | html %]" > }; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var smtp_servers_url = "/api/v1/config/smtp_servers"; > window.smtp_servers = $("#smtp_servers").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt >index 10ba5b9cfc7..d6558b6ac6e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping.tt >@@ -88,7 +88,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#form01").submit(function (event) { > if (window.opener) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt >index 0e9c7b2b929..eba77b6b069 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/sru_modmapping_auth.tt >@@ -87,7 +87,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#form01").submit(function (event) { > if (window.opener) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >index fb43af57404..a56ade1cd74 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/systempreferences.tt >@@ -493,7 +493,7 @@ > [% INCLUDE 'wysiwyg-systempreferences.inc' %] > [% IF else && loop %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#sysprefst").kohaTable({ > dom: '<"top pager"ilf>t', >@@ -504,7 +504,7 @@ > [% END %] > > [% IF ( add_form ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".variabletype").css({ color: "#0000CC", cursor: "pointer" }); > $(".variabletype").click(function () { >@@ -513,7 +513,7 @@ > }); > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // FIXME: many of these js functions appear unused > function isNotNull(f, noalert) { > if (f.value.length == 0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transfer_limits.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transfer_limits.tt >index 0fc767c6d4b..8fe52a85faf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transfer_limits.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transfer_limits.tt >@@ -15,7 +15,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > td { > text-align: center; > } >@@ -146,7 +146,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const branchTransferLimitsType = "[% BranchTransferLimitsType | html %]"; > const val_type = branchTransferLimitsType == "itemtype" ? "item_type" : "collection_code"; > const branches = [% To.json(branches) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt >index 0b1c848393e..8653f10ca63 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/transport-cost-matrix.tt >@@ -12,7 +12,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .disabled-transfer { > background-color: #ff8888; > } >@@ -105,7 +105,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/admin-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function check_transport_cost(e) { > var val = e.value; > if (val && val != "" && !isNaN(parseFloat(val)) && val >= 0.0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt >index a4720ea0194..ca00025e5fe 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/usage_statistics.tt >@@ -264,7 +264,7 @@ > [% INCLUDE 'calendar.inc' %] > [% Asset.js("js/admin-menu.js") | $raw %] > [% Asset.js("/lib/leaflet/leaflet.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function positionMap() { > var tbh = $("#mapid"); > var mapContainer = tbh.parent(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt >index 4b481dd7cb6..0e3cc4016c7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/z3950servers.tt >@@ -274,7 +274,7 @@ > [% END %] > > [% IF server %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const server = { > syntax: "[% server.syntax | html %]", > encoding: "[% server.encoding | html %]", >@@ -284,7 +284,7 @@ > [% END %] > > [% IF op == 'edit_form' || op == 'add_form' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // Update selects for syntax, encoding and recordtype > if (typeof server !== "undefined") { >@@ -329,7 +329,7 @@ > } > </script> > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#serverst").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >index 4a0a2109049..751f4abcfc3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/auth.tt >@@ -291,7 +291,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready( function() { > if ( document.location.hash ) { > const input = $('<input name="auth_forwarded_hash" type="hidden">') >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/auth_finder.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/auth_finder.tt >index ad205a01dc1..822791e5ec0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/auth_finder.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/auth_finder.tt >@@ -20,7 +20,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var index = "[% index | html %]"; > var authtypecode = "[% authtypecode | html %]"; > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt >index 1809a110cef..fb12d72d7f8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities-home.tt >@@ -40,7 +40,7 @@ > [%- END -%] > [% END %] > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const searchType = "[% marclist | html %]"; > </script> > [% Asset.js("js/authorities.js") | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >index bc0b357e48b..b490729c3e1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/authorities.tt >@@ -16,7 +16,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% INCLUDE 'select2.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF Koha.Preference('CreateAVFromCataloguing') && CAN_user_parameters_manage_auth_values %] > var auth_values_creation = 1; > [% ELSE %] >@@ -26,7 +26,7 @@ > </script> > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] > [% Asset.js("js/cataloging.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(window).load(function(){ > $("#loading").hide(); > }); >@@ -384,7 +384,7 @@ > }); > </script> > [% Asset.css("css/addbiblio.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #auloadpreview { > font-family: monospace; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >index 3812099def3..f9acef4505b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/blinddetail-biblio-search.tt >@@ -17,7 +17,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > [% IF rancor %] > function RancorReplaceField( new_text, ind_1, ind_2 ){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/detail.tt >index 2b4a57dcd3e..3cd5b2523c7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/detail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/detail.tt >@@ -134,7 +134,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const authid = "[% authid | html %]"; > const searchType = "[% marclist | html %]"; > </script> >@@ -142,7 +142,7 @@ > [% IF ( displayhierarchy ) %] > [% Asset.js("lib/jquery/plugins/jstree/jstree-3.3.12.min.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > if( $("#authoritiestabs .tab-pane.active").length < 1 ){ > let tab_object = []; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt >index 1ddf1ca63d3..9f96e693cff 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/merge.tt >@@ -12,7 +12,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > div.record ul, > div.record li { > float: none; >@@ -140,12 +140,12 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const searchType = ""; > </script> > [% Asset.js("js/authorities.js") | $raw %] > [% Asset.js("js/merge-record.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // When submiting the form > function mergeformsubmit() { > $('#tabs').remove(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tt >index 363ae676a31..d030598a9b4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist-auth.tt >@@ -13,7 +13,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/addbiblio.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .usefor { > padding: 0; > margin: 0; >@@ -142,7 +142,7 @@ > [% INCLUDE 'authority-detail-modal.inc' %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var index = "[% index | html %]"; > var authtypecode = "[% authtypecode | html %]"; > const searchType = "[% marclist | html %]"; >@@ -150,7 +150,7 @@ > </script> > [% Asset.js("js/auth-finder-search.js") | $raw %] > [% Asset.js("js/authorities-detail-modal.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function jumpfull(page){ > window.open(page,'','width=100,height=100,resizable=yes,toolbar=false,scrollbars=yes,top'); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt >index 861eca86c30..d71851a35e1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/authorities/searchresultlist.tt >@@ -13,7 +13,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/addbiblio.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .usefor { > padding: 0; > margin: 0; >@@ -155,7 +155,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const searchType = "[% marclist | html %]"; > const template_path = "[% interface | html %]/[% theme | html %]"; > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/batch/print-notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/batch/print-notices.tt >index 44a6637d26a..4a72040386e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/batch/print-notices.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/batch/print-notices.tt >@@ -9,7 +9,7 @@ > > <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> > <!-- prettier-ignore-start --> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > <!-- > .message { page-break-after: always } > pre { font-family: monospace } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt >index b744f730a4a..d4bdb6e4ff0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/bookings/list.tt >@@ -56,17 +56,17 @@ > [% INCLUDE 'js-date-format.inc' %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/modals/place_booking.js") | $raw %] > [% Asset.js("js/cancel_booking_modal.js") | $raw %] > [% Asset.js("js/combobox.js") | $raw %] > [% Asset.js("js/additional-filters.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var cancel_success = 0; > var update_success = 0; > var bookings_table; >@@ -76,7 +76,7 @@ > CAN_user_circulate_manage_bookings: [% CAN_user_circulate_manage_bookings ? 1 : 0 | html %], > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var items = $.ajax({ > url: "/api/v1/biblios/%s/items?bookable=1".format(biblionumber), >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt >index 85c511aa8a3..d08d7ae73ab 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/ISBDdetail.tt >@@ -76,10 +76,10 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/catalog.js") | $raw %] >@@ -92,13 +92,13 @@ > > [% Asset.js("js/browser.js") | $raw %] > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt >index 66a5774709d..6a12ccf5cd7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/MARCdetail.tt >@@ -200,10 +200,10 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/catalog.js") | $raw %] >@@ -216,13 +216,13 @@ > > [% Asset.js("js/browser.js") | $raw %] > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt >index 736eef6f956..b8c9df3eb73 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/advsearch.tt >@@ -399,7 +399,7 @@ > [% Asset.js("js/browser.js") | $raw %] > [% Asset.css("css/humanmsg.css") | $raw %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /** > * Function add_field(); > * This function allows to display a new field to search. >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt >index 763cda06baf..9151a4fa649 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/detail.tt >@@ -1283,14 +1283,14 @@ > [% PROCESS build_items_table_js biblio => biblio %] > > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] > [% IF ( ( Koha.Preference('CatalogConcerns') || Koha.Preference('OpacCatalogConcerns') ) && CAN_user_editcatalogue_edit_catalogue ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > $("#bibliodetails a:first").tab("show"); > var table_settings = [% TablesSettings.GetTableSettings( 'catalogue', 'concerns', 'table_concerns', 'json' ) | $raw %]; >@@ -1451,7 +1451,7 @@ > </script> > [% Asset.js("js/modals/display_ticket.js") | $raw %] > [% END # /IF CatalogConcerns %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var interface = "[% interface | html %]"; > var theme = "[% theme | html %]"; > // http://www.oreillynet.com/pub/a/javascript/2003/10/21/amazonhacks.html >@@ -1725,10 +1725,10 @@ > [% INCLUDE 'js-date-format.inc' %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% INCLUDE 'js-biblio-format.inc' %] >@@ -1737,7 +1737,7 @@ > [% IF Koha.Preference('EnableBooking') %] > [% Asset.js("js/modals/place_booking.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var browser; > browser = KOHA.browser("[% searchid | html %]", parseInt(biblionumber, 10)); > browser.show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/imageviewer.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/imageviewer.tt >index ef094d22889..7054f7f9ab1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/imageviewer.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/imageviewer.tt >@@ -11,7 +11,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #largeCover { > background: transparent url("[% interface | html %]/[% theme | html %]/img/spinner-small.gif") center center no-repeat; > } >@@ -130,10 +130,10 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/catalog.js") | $raw %] >@@ -145,13 +145,13 @@ > [% END %] > > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var interface = "[% interface | html %]"; > var theme = "[% theme | html %]"; > $(document).ready(function(){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/issuehistory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/issuehistory.tt >index eba58ef173a..5307c4a007a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/issuehistory.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/issuehistory.tt >@@ -127,7 +127,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > var table_settings = [% TablesSettings.GetTableSettings('catalogue', 'detail', 'checkoutshistory-table', 'json') | $raw %]; > [% UNLESS show_patron_column %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >index 7e0a947f5e7..15884b65249 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/itemsearch.tt >@@ -387,7 +387,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var authorised_values = [% authorised_values_json | $raw %]; > > function showItemSelections( number ){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt >index aff14ecbb70..8056eac4c55 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/labeledMARCdetail.tt >@@ -89,10 +89,10 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/catalog.js") | $raw %] >@@ -105,13 +105,13 @@ > [% END %] > > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > //<![CDATA[ > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt >index f9313d0dd20..4397f44e8de 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/moredetail.tt >@@ -16,7 +16,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .listgroup .rows { > margin-left: 1em; > } >@@ -586,10 +586,10 @@ > [% INCLUDE 'js-date-format.inc' %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrBefore.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrBefore); > </script> > [% Asset.js("js/catalog.js") | $raw %] >@@ -603,13 +603,13 @@ > [% END %] > > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >index 6ac67649634..75796aad548 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/results.tt >@@ -968,7 +968,7 @@ > [% Asset.css("css/humanmsg.css") | $raw %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var PREF_AmazonCoverImages = parseInt( "[% Koha.Preference('AmazonCoverImages') | html %]", 10); > var q_array = new Array(); // will hold search terms, if present > var PREF_IntranetCoce = parseInt( "[% Koha.Preference('IntranetCoce') | html %]", 10); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt >index 1a829bcc7f4..94d6f22a4a2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/search-history.tt >@@ -218,7 +218,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // We show table ordered by descending dates by default > // (so that the more recent query is shown first) >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/showelastic.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/showelastic.tt >index c90d443e425..4ae69af6052 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/showelastic.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/showelastic.tt >@@ -11,7 +11,7 @@ > <pre id="main" style="direction: ltr;"> </pre> > </body> > <footer> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > textarea { > width: 100%; > min-height: 40em; >@@ -19,7 +19,7 @@ > resize: none; > } > </style> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > display(); > > function display() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt >index 1b2e2a861b9..dc4ebc49238 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/catalogue/stockrotation.tt >@@ -192,7 +192,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/browser.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >index 809cc3abfa4..a1e597fda94 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbiblio.tt >@@ -18,7 +18,7 @@ > [% INCLUDE 'calendar.inc' %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] > [% INCLUDE 'select2.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF Koha.Preference('CreateAVFromCataloguing') && CAN_user_parameters_manage_auth_values %] > var auth_values_creation = 1; > [% ELSE %] >@@ -28,7 +28,7 @@ > </script> > [% Asset.js("js/cataloging.js") | $raw %] > [% Asset.js("js/browser.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var browser = KOHA.browser('[% searchid | html %]', parseInt('[% biblionumber | html %]', 10)); > browser.show(); > >@@ -891,7 +891,7 @@ > [% END # /UNLESS number %] > <!-- prettier-ignore-start --> > [% IF ( done ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > opener.document.forms['f'].biblionumber.value=[% biblionumber | html %]; > opener.document.forms['f'].title.value='[% title | html %]'; > window.close(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >index 8fd5a65650a..c0191641d1f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/addbooks.tt >@@ -326,7 +326,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > //Set focus to cataloging search > $("input[name=q]:eq(0)").focus(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt >index 0e6c6a6c812..d81bf8021b8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/additem.tt >@@ -24,7 +24,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/addbiblio.css") | $raw %] > [% INCLUDE 'datatables.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF Koha.Preference('CreateAVFromCataloguing') && CAN_user_parameters_manage_auth_values %] > var auth_values_creation = 1; > [% ELSE %] >@@ -37,10 +37,10 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'str/cataloging_additem.inc' %] > [% Asset.js("js/cataloging_additem.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var has_item_groups = "[% item_groups.size | html %]"; > </script> >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .flatpickr_wrapper input { > width: 100%; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >index 15cdf690cd8..b98e361d709 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/cataloging-home.tt >@@ -218,7 +218,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > > $("#newRecord").click(function(){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/concerns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/concerns.tt >index 84618dde7c8..345e1433eec 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/concerns.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/concerns.tt >@@ -63,7 +63,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% INCLUDE 'js-biblio-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > > logged_in_user_borrowernumber = [% logged_in_user.borrowernumber | html %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt >index cbfa421a54e..98fad5827b1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/merge.tt >@@ -12,7 +12,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > div.record ul, > div.record li { > float: none; >@@ -216,7 +216,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/merge-record.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% UNLESS (result) %] > [% IF (choosereference) %] > function changeFramework(fw) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt >index fda67cbf806..19c7e758488 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/moveitem.tt >@@ -122,7 +122,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#delete-biblio-btn").on("click", function () { > if (confirm(_("Are you sure you want to delete this record?"))) { > $("#del-bib-spn").show(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/EXAMPLE.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/EXAMPLE.tt >index dd15cb731c5..c3694db7fa8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/EXAMPLE.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/EXAMPLE.tt >@@ -30,7 +30,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $('#return').focus(); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_006.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_006.tt >index a0200f88f1b..bf6cdd9533d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_006.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_006.tt >@@ -51,7 +51,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/xmlControlfield.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var objXmlControlField; > var tr_result; > var h4_result; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_007.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_007.tt >index 80fd4914677..e3ae2665072 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_007.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_007.tt >@@ -114,7 +114,7 @@ > <!-- /.page-section --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008.tt >index 7f369d964df..d9708a335b6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008.tt >@@ -64,7 +64,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/xmlControlfield.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $(".close_window").on("click", function(e){ > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_authorities.tt >index e92feb560f8..a2b03a1bc51 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_authorities.tt >@@ -736,7 +736,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_classifications.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_classifications.tt >index 8d26e05e12c..328a4dd1333 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_classifications.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_field_008_classifications.tt >@@ -219,7 +219,7 @@ > <!-- /.page-section --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader.tt >index 46900a47c0f..7561ad34170 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader.tt >@@ -366,7 +366,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader_authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader_authorities.tt >index 5b3684e27ba..cadea26f252 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader_authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_leader_authorities.tt >@@ -140,7 +140,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt >index d929e4ecde7..3792af7968a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/marc21_linking_section.tt >@@ -163,7 +163,7 @@ > > [% MACRO jsinclude BLOCK %] > [% IF ( fillinput ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function go() { > > var index_start = "[% index | html %]"; >@@ -251,7 +251,7 @@ > window.close(); > </script> > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report(value2report) { > if (document.f_pop.result.value.length == 0) { > document.f_pop.result.value = value2report; >@@ -268,7 +268,7 @@ > } > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function jumpfull(page) { > window.open(page, "", "width=100,height=100,toolbar=false,scrollbars=yes"); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100.tt >index 9587c9dcf35..8c5d1e2cd6e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100.tt >@@ -801,7 +801,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100_authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100_authorities.tt >index 576df70d4aa..8555431fded 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100_authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_100_authorities.tt >@@ -354,7 +354,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_105.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_105.tt >index df1e8d4cefc..6056f0640af 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_105.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_105.tt >@@ -1156,7 +1156,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_106.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_106.tt >index 4ff15892bf8..291103cabcb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_106.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_106.tt >@@ -94,7 +94,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_110.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_110.tt >index 2f00d04c0d4..996b6658bfa 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_110.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_110.tt >@@ -638,7 +638,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f5.value=document.f_pop.f5.value+' '; > document.f_pop.f5.value=document.f_pop.f5.value.substring(0,3); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115a.tt >index 31b3c33131f..96f91411d92 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115a.tt >@@ -1127,7 +1127,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f2.value=document.f_pop.f2.value+' '; > document.f_pop.f2.value=document.f_pop.f2.value.substring(0,3); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115b.tt >index 9a3b4071473..4b3f229f5dc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_115b.tt >@@ -594,7 +594,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f10.value=document.f_pop.f10.value+' '; > document.f_pop.f10.value=document.f_pop.f10.value.substring(0,4); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_116.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_116.tt >index 285474fcb42..ee1dcc4a615 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_116.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_116.tt >@@ -1417,7 +1417,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_117.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_117.tt >index a67019c867f..e95924e1189 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_117.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_117.tt >@@ -723,7 +723,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_120.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_120.tt >index 4139b30790b..b5d733388d8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_120.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_120.tt >@@ -1145,7 +1145,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121a.tt >index ae3b36ceaf1..df9d5224d4d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121a.tt >@@ -358,7 +358,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121b.tt >index 73f1afe2973..130a4f0d10d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_121b.tt >@@ -255,7 +255,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f3.value=document.f_pop.f3.value+' '; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_122.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_122.tt >index 644f7e1886a..f3523201758 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_122.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_122.tt >@@ -59,7 +59,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f2.value=document.f_pop.f2.value+' '; > document.f_pop.f3.value=document.f_pop.f3.value+' '; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123a.tt >index 3178e233254..a706db3c1da 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123a.tt >@@ -52,7 +52,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123defg.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123defg.tt >index dd96f2918f3..70a1df7d246 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123defg.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123defg.tt >@@ -70,7 +70,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f2.value=document.f_pop.f2.value+' '; > document.f_pop.f3.value=document.f_pop.f3.value+' '; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123i_j.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123i_j.tt >index 208cb19500f..c81f3b67cd2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123i_j.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_123i_j.tt >@@ -61,7 +61,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var f2= "000" + document.f_pop.f2.value; > f2 = f2.substring(f2.length-3); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124a.tt >index e5760584731..124c0930729 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124a.tt >@@ -53,7 +53,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124b.tt >index 3553fed3ca3..50c99022c81 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124b.tt >@@ -93,7 +93,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124c.tt >index 8b91ef22e12..a8853af0036 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124c.tt >@@ -148,7 +148,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124d.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124d.tt >index 1577052e4f1..df011a0b1f9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124d.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124d.tt >@@ -53,7 +53,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124e.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124e.tt >index aff737f42f9..50ae630fdd9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124e.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124e.tt >@@ -53,7 +53,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124f.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124f.tt >index e976dde8e42..212995b1ff8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124f.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124f.tt >@@ -128,7 +128,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124g.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124g.tt >index 5ccfd5b5b5e..d17499e5a3e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124g.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_124g.tt >@@ -88,7 +88,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125a.tt >index 727aa9480ea..0e3c3e53110 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125a.tt >@@ -155,7 +155,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125b.tt >index 44bbba7b4f0..5066a7f9357 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_125b.tt >@@ -148,7 +148,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126a.tt >index 08e69b48563..b2b70cdfe83 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126a.tt >@@ -1057,7 +1057,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126b.tt >index 6338e4bc804..143bf2bef0f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_126b.tt >@@ -192,7 +192,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_127.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_127.tt >index a84095aaf50..ec1a31946f5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_127.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_127.tt >@@ -40,7 +40,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > document.f_pop.f1.value=document.f_pop.f1.value+' '; > document.f_pop.f2.value=document.f_pop.f2.value+' '; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128a.tt >index f9c83f28591..f11d2d3f370 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128a.tt >@@ -387,7 +387,7 @@ > </nav> > </form> > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128b.tt >index 7dcec60e420..6749bf2f4e6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128b.tt >@@ -483,7 +483,7 @@ > </nav> > </form> > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128c.tt >index 24bcd5a237d..74ed29706f3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_128c.tt >@@ -478,7 +478,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_130.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_130.tt >index e259e60dd3b..a3d5ded1def 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_130.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_130.tt >@@ -352,7 +352,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > document.f_pop.f5.value=document.f_pop.f5.value+' '; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_135a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_135a.tt >index 0c535d090f5..1f7147dd181 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_135a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_135a.tt >@@ -469,7 +469,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_140.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_140.tt >index 1309e6bff11..de21a371991 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_140.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_140.tt >@@ -1732,7 +1732,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_141.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_141.tt >index 2b793368a3b..573e4bffabe 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_141.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_141.tt >@@ -387,7 +387,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var dateformat = "[% Koha.Preference('dateformat') | html %]"; > function report() { > var doc = opener.document; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146a.tt >index 701393be7ea..a3be89c3e4e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146a.tt >@@ -45,7 +45,7 @@ > </nav> > </form> > </div> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146b.tt >index b2e5439a695..892faa24ff7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146b.tt >@@ -120,12 +120,12 @@ > </form> > > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#category").select2(); > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146c.tt >index efdea28cb64..8677618d4af 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146c.tt >@@ -121,12 +121,12 @@ > </form> > > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#category").select2(); > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146d.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146d.tt >index 6dd66ccb263..4f1f75263fd 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146d.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146d.tt >@@ -98,12 +98,12 @@ > </form> > > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#category").select2(); > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146e.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146e.tt >index fe873df0721..3853a277bee 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146e.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146e.tt >@@ -122,12 +122,12 @@ > </div> > > [% INCLUDE 'select2.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#category").select2(); > }); > </script> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146f.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146f.tt >index a340e6d2262..0ab35b53dfc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146f.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146f.tt >@@ -122,12 +122,12 @@ > </div> > > [% INCLUDE 'select2.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#category").select2(); > }); > </script> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146h.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146h.tt >index 350775c8118..bfe39e77142 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146h.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146h.tt >@@ -52,7 +52,7 @@ > </nav> > </form> > </div> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146i.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146i.tt >index 70c5982d671..a6fa1ddb893 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146i.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_146i.tt >@@ -52,7 +52,7 @@ > </nav> > </form> > </div> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > document.getElementById("form").addEventListener("submit", function (ev) { > ev.preventDefault(); > const id = document.getElementById("id").value; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181-2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181-2.tt >index 96876beef6d..ad4c0039f91 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181-2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181-2.tt >@@ -60,7 +60,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181a.tt >index dee4a5b8ed9..749f27e78db 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181a.tt >@@ -144,7 +144,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181b.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181b.tt >index bc467e41c62..55da6b1bc14 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181b.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181b.tt >@@ -252,7 +252,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > // The following function just puts back the value of the input #return > // into the caller's field, referenced by index. And closes the popup. > function submitMyForm() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181c.tt >index 562e54d311a..aef293f73ed 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_181c.tt >@@ -186,7 +186,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182-2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182-2.tt >index 7edca0a0f1a..dee22c0f969 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182-2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182-2.tt >@@ -60,7 +60,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182a.tt >index 2179e6ef710..1c9274639e2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182a.tt >@@ -96,7 +96,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182c.tt >index 54482ec0202..3f1b4d9ad20 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_182c.tt >@@ -96,7 +96,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183-2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183-2.tt >index 65618130b58..bf0cbc9036d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183-2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183-2.tt >@@ -60,7 +60,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > // The following function just puts back the value of the input #return > // into the caller's field, referenced by index. And closes the popup. > function submitMyForm() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183a.tt >index 0ac57580bc0..d193b145c78 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_183a.tt >@@ -394,7 +394,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt >index a0f925464b2..b7e025a9d3e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c.tt >@@ -108,7 +108,7 @@ > </div> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $(".choosebt").on("click",function(){ > var toreport = $(this).siblings(".toreport").text(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt >index 5d0c76feaa7..8932eef3a5c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt >@@ -34,7 +34,7 @@ > </div> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a.tt >index ce180c98876..d431f3e92fe 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a.tt >@@ -42,7 +42,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt >index 16aad159f6b..5b883bf7811 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt >@@ -36,7 +36,7 @@ > </div> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $("#findvalue").autocomplete({ > source: "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=collectiontitle", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283-2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283-2.tt >index 0da0aa7024e..f436e2d7410 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283-2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283-2.tt >@@ -60,7 +60,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > // The following function just puts back the value of the input #return > // into the caller's field, referenced by index. And closes the popup. > function submitMyForm() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283a.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283a.tt >index a628c3429a9..7db8f5b47f7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283a.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_283a.tt >@@ -395,7 +395,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325h.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325h.tt >index 9d8ac5bfe2c..3e42e8f6ac0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325h.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325h.tt >@@ -55,7 +55,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function submitMyForm() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325j.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325j.tt >index 318a1ab0384..c03a58d521e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325j.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_325j.tt >@@ -144,7 +144,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $("#form").on('submit', submitMyForm); > $("#f0").on('change', function() { > document.f_pop.f1.disabled = false; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >index db52d39828d..178c70f67de 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_4XX.tt >@@ -173,7 +173,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".redirect_link").on("click", function (e) { > e.preventDefault(); >@@ -187,7 +187,7 @@ > } > </script> > [% IF ( fillinput ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function go() { > var index_start = "[% index | html %]"; > var whichfield; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader.tt >index 448cfa1e55b..b0f52466e09 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader.tt >@@ -311,7 +311,7 @@ > </form> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt >index b22ee964acc..37f6aca3406 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_leader_authorities.tt >@@ -194,7 +194,7 @@ > </div> > </nav> > </form> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function report() { > var doc = opener.document; > var field = doc.getElementById("[% index | html %]"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt >index d00d7f2bf4a..f94a3495565 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_auth_search.tt >@@ -263,7 +263,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'z3950_search.inc' %] > [% Asset.js("js/z3950_search.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#resultst").kohaTable({ > dom: "t", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt >index 888eb99889c..a0128a3bab5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/z3950_search.tt >@@ -276,7 +276,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'z3950_search.inc' %] > [% Asset.js("js/z3950_search.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > var table_settings = [% TablesSettings.GetTableSettings( 'cataloguing', 'z3950_search', 'resultst', 'json' ) | $raw %]; > var thetable = $("#resultst").kohaTable( >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt >index cfb47daa5c4..d158c303445 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/article-requests.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > p { > margin-top: 0; > } >@@ -523,7 +523,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var active_tab = "#article-requests-requested_panel"; > var last_cancel_reason, requested_datatable, pending_datatable, processing_datatable, active_datatable, requested_dt, pending_dt, processing_dt; > $(document).ready(function() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/bookcount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/bookcount.tt >index 9aea177f377..81f677355cd 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/bookcount.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/bookcount.tt >@@ -98,7 +98,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("tr.mybranch td").css("background-color", "#CFE7FF"); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >index c03e8ee439c..0ee74069e63 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/branchtransfers.tt >@@ -15,7 +15,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #tobranchcd-error { > display: block; > } >@@ -295,7 +295,7 @@ > [% END %] > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(".printtransferslip").on("click", function(e){ > e.preventDefault(); > var itemnumber = $(this).attr('data-itemnumber'); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt >index 5130a113e9a..663cb0171eb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/checkout-notes.tt >@@ -118,7 +118,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#notestable").kohaTable({ > order: [[1, "asc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >index 672d27da176..5ddf07fe39b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation.tt >@@ -25,7 +25,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #patron_checkout_search { > display: flex; > gap: 0.5rem; >@@ -1080,7 +1080,7 @@ > [% PROCESS 'modal-claims.inc' %] > [% PROCESS 'modal-claims-js' %] > [% INCLUDE 'js-date-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set some variable needed in circulation.js */ > const LoadCheckoutsTableDelay = [% Koha.Preference('LoadCheckoutsTableDelay') || 0 | html %]; > const AlwaysLoadCheckoutsTable = [% Koha.Preference('AlwaysLoadCheckoutsTable') | html %]; >@@ -1115,7 +1115,7 @@ > [% Asset.js("js/combobox.js") | $raw %] > [% INCLUDE 'js-biblio-format.inc' %] > [% Asset.js("js/hold-group.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > table_settings_issues_table = [% TablesSettings.GetTableSettings( 'circ', 'circulation', 'issues-table', 'json' ) | $raw %] > table_settings_relatives_issues_table = [% TablesSettings.GetTableSettings( 'circ', 'circulation', 'relatives-issues-table', 'json' ) | $raw %] > table_settings_holds_table = [% TablesSettings.GetTableSettings( 'circ', 'circulation', 'holds-table', 'json' ) | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt >index 94fe4f8edb2..70f200fba6f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/circulation_batch_checkouts.tt >@@ -244,7 +244,7 @@ > [% END %] > [% IF checkout_info.HIGHHOLDS %] > <!-- FIXME --> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > $("input[name=duedatespec]:hidden").val('[% checkout_info.HIGHHOLDS.returndate | html %]'); > }); >@@ -352,7 +352,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > if($('#barcodelist').length) { > $('#barcodelist').focus(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt >index 7360ff45386..99b187a6d92 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/curbside_pickups.tt >@@ -16,7 +16,7 @@ > › [% t("Circulation") | html %] › [% t("Koha") | html %] > [% END %]</title > > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #pickup-times { > width: 50%; > } >@@ -461,15 +461,15 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_customParseFormat); > </script> > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let pickups = [% To.json(curbside_pickups.unblessed) | $raw %]; > let policy = [% To.json(policy.unblessed) | $raw %]; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/on-site_checkouts.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/on-site_checkouts.tt >index bb315fd622f..0d67434b88c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/on-site_checkouts.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/on-site_checkouts.tt >@@ -77,7 +77,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > if ($("#pending_onsite_checkout").length) { > $("#pending_onsite_checkout").kohaTable(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt >index 1bc2b58b50d..5847c8b25e2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/overdue.tt >@@ -21,7 +21,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >@@ -346,7 +346,7 @@ > [% INCLUDE 'select2.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% PROCESS 'modal-claims-js' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function clone_input( node, original_id ) { > var original = node; > var clone = original.clone(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingbookings.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingbookings.tt >index 6b008e35045..4ffc7faeff4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingbookings.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingbookings.tt >@@ -115,7 +115,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-biblio-format.inc' %] > [% INCLUDE 'js-date-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let table_settings = [% TablesSettings.GetTableSettings( 'circ', 'bookings', 'bookings-to-collect', 'json' ) | $raw %]; > > let all_libraries = [% To.json(Branches.all) | $raw %].map(e => { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt >index 2b74dbe86c7..c30bc890934 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/pendingreserves.tt >@@ -298,7 +298,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/hold-group.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function get_options(column){ > let regex = /(<([^>]+)>)/ig; // Remove html tags > let options = [... new Set(column >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt >index a4d3d52f737..2e227d447a5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/printslip.tt >@@ -38,7 +38,7 @@ > [% FOR slip IN slips %] > [% IF slip.style %] > <!-- prettier-ignore-start --> >- <style>[% slip.style.replace('([^\{\}]+?)\s*\{', '#slip_' _ slip.id _ ' $1 {') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% slip.style.replace('([^\{\}]+?)\s*\{', '#slip_' _ slip.id _ ' $1 {') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt >index ffd2bd911cd..90659df0e21 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/renew.tt >@@ -240,7 +240,7 @@ > [% Asset.js("js/pages/circulation.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% IF error %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > removeFocus(); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >index ea1e38ee77c..e9ecd27e31b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/request-article.tt >@@ -337,7 +337,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $('#current-article-requests').ready(function() { > $(".hide").hide(); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt >index 380d3fa3d86..b1d92760c51 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/reserveratios.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >@@ -214,7 +214,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'circ', 'holdsratios', 'holds-ratios', 'json' ) | $raw %]; > $(document).ready(function() { > $("#holds-ratios").kohaTable( >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >index 5d3cc6975f6..6e87293f028 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/returns.tt >@@ -1506,20 +1506,20 @@ > [% Asset.js("js/pages/circulation.js") | $raw %] > [% Asset.js("js/modal_printer.js") | $raw %] > [% IF ( ReturnClaims ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by resolve_claim_modal.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/resolve_claim_modal.js") | $raw %] > [% END %] > [% IF ( Koha.Preference('CatalogConcerns') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set a variable needed by add_catalog_concern.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/modals/add_catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function Dopop(link) { > var newin = window.open(link, 'popup', 'width=600,height=400,resizable=1,toolbar=0,scrollbars=1,top'); > $("#barcode").focus(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt >index 8759c5eab8c..2505e385b0b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/set-library.tt >@@ -21,7 +21,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .noshow { > display: none; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transfers_to_send.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transfers_to_send.tt >index 2718e62e3da..fd3876a1708 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transfers_to_send.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transfers_to_send.tt >@@ -96,7 +96,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% FOREACH library IN libraries %] > $("#transferst[% library.branchcode | html %]").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt >index 18e38df03c1..406abfa3563 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/transferstoreceive.tt >@@ -117,7 +117,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% FOREACH branchesloo IN branchesloop %] > $("#transferst[% branchesloo.branchcode | html %]").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/view_holdsqueue.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/view_holdsqueue.tt >index facdba84331..38b336ffa76 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/view_holdsqueue.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/view_holdsqueue.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > p { > margin-top: 0; > } >@@ -380,7 +380,7 @@ > [% INCLUDE 'select2.inc' %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/hold-group.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > // Apply select2 to all select fields having a "multiple" attribute > let selectFields = document.querySelectorAll('select[multiple]'); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt >index 8c5b6f337be..7b8f7ce1e92 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/circ/waitingreserves.tt >@@ -16,7 +16,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .tab-toolbar { > padding: 0.5rem 0; > margin-bottom: 0.5rem; >@@ -204,7 +204,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_CANCEL_SELECTED = _("Cancel selected (%s)"); > var holdst_table_settings = [% TablesSettings.GetTableSettings( 'circ', 'holds_awaiting_pickup', 'holdst', 'json' ) | $raw %]; > var holdso_table_settings = [% TablesSettings.GetTableSettings( 'circ', 'holds_awaiting_pickup', 'holdso', 'json' ) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/club-enrollments.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/club-enrollments.tt >index d4f04c5aeac..133d5879947 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/club-enrollments.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/club-enrollments.tt >@@ -91,7 +91,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > eTable = $("#enrollments-table").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >index a1c911bc932..b56940e986c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/clubs.tt >@@ -146,7 +146,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > tTable = $("#club-templates-table").kohaTable({ > pagingType: "full", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-clubs-tab.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-clubs-tab.tt >index c3caa6c5271..ce8a958708e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-clubs-tab.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-clubs-tab.tt >@@ -58,7 +58,7 @@ > </tbody> > </table> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var clubs_dt_params = { > paging: true, > }; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-enroll.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-enroll.tt >index 3f37ed910b0..19d0a87ccef 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-enroll.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/patron-enroll.tt >@@ -58,7 +58,7 @@ > </fieldset> > </form> > </div> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > if([% enrollent_id | html %]){ > $("#heading").html(_("Modifying enrollment")+" <em>[% club.name | html %]</em>"); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt >index 86838b098a9..b066ca568b6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/clubs/templates-add-modify.tt >@@ -18,7 +18,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .club-field, > .enrollment-field { > border-top: 1px solid #ddd; >@@ -252,7 +252,7 @@ > </div> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("body").on("click", ".add_club_field", function (e) { > e.preventDefault(); > $("#new-field-template").clone().attr("id", "").show().appendTo("#club-template-fields"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt >index 89e683d0b0e..682818bff87 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step1.tt >@@ -78,7 +78,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("input[type='submit']").click(function (e) { > if ($("#biblionumber").val().length > 0 && $("#barcode").val().length > 0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt >index 30b656e1e64..f4d88f3e274 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/add_items-step2.tt >@@ -232,7 +232,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".field-toggle").change(function () { > if (this.checked) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt >index d3ab0b4bfb6..60e19583d27 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_add_items.tt >@@ -213,7 +213,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > //<![CDATA[ > $(document).ready(function () { > $(".field-toggle").change(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt >index 60998524255..7d5eae22de8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/batch_rm_items.tt >@@ -86,7 +86,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#batch_rm_btn").click(function () { > return confirmDelete(_("Are you sure you want to remove these items from all courses?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >index f0002c63139..1294bcca52a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-details.tt >@@ -18,7 +18,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .biblio-level-info { > background-color: #f3f3f3; > border-radius: 5px; >@@ -360,7 +360,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'coursereserves', 'reserves', 'course_reserves_table', 'json' ) | $raw %]; > $(document).ready(function(){ > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >index a13e0f73ca5..6a4bbcbf625 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course-reserves.tt >@@ -94,7 +94,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'coursereserves', 'courses', 'course_reserves_table', 'json' ) | $raw %]; > $(document).ready(function() { > var ctable = $("#course_reserves_table").kohaTable( >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >index ac3202e5cf3..07418859ca7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/course_reserves/course.tt >@@ -15,7 +15,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #course_instructors { > float: left; > } >@@ -192,7 +192,7 @@ > > [% IF ( departments ) %] > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > patron_autocomplete($("#find_instructor"), { > "on-select-add-to": { container: $("#instructors"), input_name: "instructors" }, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt >index 85f48a27bb3..298c968864b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/erm/erm.tt >@@ -27,7 +27,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-date-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const agreement_table_settings = [% TablesSettings.GetTableSettings( 'erm', 'agreements', 'agreements', 'json' ) | $raw %]; > const license_table_settings = [% TablesSettings.GetTableSettings( 'erm', 'licenses', 'licenses', 'json' ) | $raw %]; > const eholdings_packages_table_settings = [% TablesSettings.GetTableSettings( 'erm', 'eholdings', 'packages', 'json' ) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >index 237f3392f79..7d835ca8f5e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/ill/ill-requests.tt >@@ -83,7 +83,7 @@ > [% WRAPPER 'main-container.inc' wide_centered => ( op == 'illlist' ? 0 : 1 ) aside = ( op == 'illlist' ? 'ill-filter' : '' ) %] > > [% IF op == 'illlist' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var ill_table_actions = [% table_actions | $raw %]; > </script> > [% END %] >@@ -1121,11 +1121,11 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'select2.inc' %] > [% IF metadata_enrichment_services %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var ill_check_availability_syspref = '[% Koha.Preference('ILLCheckAvailability') | html %]'; > var metadata_enrichment_services = [% metadata_enrichment_services | $raw %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF batch_availability_services %] > var batch_availability_services = [% batch_availability_services | $raw %]; > [% ELSE %] >@@ -1133,7 +1133,7 @@ > [% END %] > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var prefilters = '[% prefilters | $raw %]'; > // Set column settings > var table_settings = [% TablesSettings.GetTableSettings( 'illrequests', 'ill-requests', 'ill-requests', 'json' ) | $raw %]; >@@ -1152,7 +1152,7 @@ > var metadata = "[% metadata | $raw %]"; > [% END %] > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#ill_checkout_inhouse_select").on("change", function () { > if ($(this).val().length > 0) { > $(".ill_checkout_due_date").hide(); >@@ -1184,7 +1184,7 @@ > [% Asset.js("js/ill-autobackend.js") | $raw %] > [% END %] > [% IF op == 'availability' && Koha.Preference('ILLCheckAvailability') %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > window.doSearch(); > }); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt >index 06be14202a2..50dcd160203 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/installer/step3.tt >@@ -482,7 +482,7 @@ > > [% IF ( selectframeworks ) %] > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".selectall,.deselectall").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >index ef569c65ee6..afa39d0021c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/intranet-main.tt >@@ -338,7 +338,7 @@ > </div> > <!-- /#container-main.container-fluid --> > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_CONFIRM_DELETE = _("Are you sure you want to delete this news item? This cannot be undone."); > $(document).ready(function () { > $(".news_delete").on("click", function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt >index 6e79487b0e9..199afbcdc6a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/barcode-print.tt >@@ -13,7 +13,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/humanmsg.css") | $raw %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > input[type="range"] { > display: inline-block; > width: auto; >@@ -126,7 +126,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var base_url = "[% Koha.Preference('staffClientBaseURL') | html %]"; > > function showBarcodeText( path, dimensions ){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >index 82a4eb7f84f..c44cc90b1f8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-batch.tt >@@ -231,7 +231,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/labels-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function dofocus() { // named function req'd for body onload event by some FF and IE7 security models > $(".focus:last").select(); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt >index 73bd4d53fa4..05bd68adf89 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-layout.tt >@@ -230,7 +230,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/labels-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $('.sidebar_menu a[href$="/cgi-bin/koha/labels/label-home.pl"]').addClass("current"); > $("input[name='layout_choice']").change(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt >index 02e3f9ab39e..a5bec7a228a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-profile.tt >@@ -130,7 +130,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/labels-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $('.sidebar_menu a[href$="/cgi-bin/koha/labels/label-home.pl"]').addClass("current"); > var selectedUnit = $("#units option:selected").val(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt >index 83e54a08266..51450cf1e37 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-range.tt >@@ -55,7 +55,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function Xport() { > var str = ""; > str += "from=" + document.getElementById("from-input").value + "&"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt >index 9e17a6ec81a..b8497a9f702 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-edit-template.tt >@@ -172,7 +172,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/labels-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $('.sidebar_menu a[href$="/cgi-bin/koha/labels/label-home.pl"]').addClass("current"); > var selectedUnit = $("#units option:selected").val(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-manage.tt >index 1284f16580e..d50245a3995 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-manage.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-manage.tt >@@ -157,7 +157,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function Xport() { > batches= new Array; > if(document.layouts.action.length > 0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt >index 6bb88091a2b..f745ef006c4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/label-print.tt >@@ -9,7 +9,7 @@ > [% END %] > </title> > [% INCLUDE 'doc-head-close.inc' popup => 1 %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > table { > border-collapse: separate; > border-spacing: 0; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/result.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/result.tt >index 0876c23f627..fa72a78c0e8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/result.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/result.tt >@@ -142,7 +142,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $("#CheckAll").click(function(e){ > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt >index 686e0d124bf..cca279294f9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-home.tt >@@ -46,7 +46,7 @@ > </form> > [% END %] > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#spinelabelprint").on("submit", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >index 3aa04fee80d..90a4b5dbe66 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/labels/spinelabel-print.tt >@@ -12,7 +12,7 @@ > > > [% INCLUDE 'doc-head-close.inc' popup => 1 %] > [% Asset.css("css/spinelabel.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > @media print { > .noprint { > display: none; >@@ -20,7 +20,7 @@ > } > </style> > <!-- prettier-ignore-start --> >-[% IF ( IntranetUserCSS ) %]<style>[% IntranetUserCSS | $raw %]</style>[% END %] >+[% IF ( IntranetUserCSS ) %]<style nonce="[% Koha.CSPNonce | $raw %]">[% IntranetUserCSS | $raw %]</style>[% END %] > <!-- prettier-ignore-end --> > </head> > >@@ -64,7 +64,7 @@ > [% IF ( autoprint ) %] > [% INCLUDE 'slip-print.inc' #printThenClose %] > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".print-label").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt >index 0415742472e..62a44f078b6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/alert-subscriptions.tt >@@ -92,7 +92,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#subscriptions").kohaTable(); > $(".unsubscribe").submit(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >index edfbf2ab2ee..58fec5b3ad2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/apikeys.tt >@@ -160,7 +160,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/copyToClipboard.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".delete").on("click", function (e) { > return confirmDelete(_("Are you sure you want to delete this key?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >index 6db3bb56424..45f77193eb8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/boraccount.tt >@@ -577,7 +577,7 @@ > [% INCLUDE 'format_price.inc' %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF payment_id && Koha.Preference('FinePaymentAutoPopup') %] > window.open('/cgi-bin/koha/members/printfeercpt.pl?action=print&change_given=[% change_given | html %]&accountlines_id=[% payment_id | html %]', '_blank'); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharges.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharges.tt >index 6dab9302f82..e90f5b97ecb 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharges.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/discharges.tt >@@ -70,7 +70,7 @@ > [% Asset.js("js/members-menu.js") | $raw %] > > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#pending_updates table").kohaTable({ > paging: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt >index 2f60223bd19..9240eb92790 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/files.tt >@@ -118,7 +118,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".confirmdelete").on("click", function () { > $(this).parents("tr").addClass("warn"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/holdshistory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/holdshistory.tt >index b4426991d99..6d59d16dfbc 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/holdshistory.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/holdshistory.tt >@@ -152,7 +152,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% INCLUDE 'js-biblio-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const all_libraries = [% To.json(Branches.all) | $raw %].map(e => { > e["_id"] = e["branchcode"]; > e["_str"] = e["branchname"]; >@@ -177,7 +177,7 @@ > > const show_itemtype_column = [% Koha.Preference('AllowHoldItemTypeSelection') ? 1 : 0 | html %]; > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > var table_settings = [% TablesSettings.GetTableSettings('members', 'holdshistory', 'holdshistory-table', 'json') | $raw %]; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >index d2247a0f6a3..93ac27d1339 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/housebound.tt >@@ -417,7 +417,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".delete").click(function () { > return confirm(_("Are you sure you want to delete this delivery?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/ill-requests.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/ill-requests.tt >index 7ed38a2ce9f..e3966ffbbe4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/ill-requests.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/ill-requests.tt >@@ -51,7 +51,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-biblio-format.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var prefilters = '[% prefilters | html %]'; > // Set column settings > var table_settings = [% TablesSettings.GetTableSettings( 'illrequests', 'ill-requests', 'ill-requests', 'json' ) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >index 93a0878c9a0..75db723aa90 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/mancredit.tt >@@ -121,7 +121,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/additional-fields-entry.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $('#mancredit').preventDoubleFormSubmit(); > $("fieldset.rows input, fieldset.rows select").addClass("noEnterSubmit"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >index cad27e33a9a..e82017ee78f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/maninvoice.tt >@@ -119,7 +119,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/additional-fields-entry.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var type_fees = {}; > [% FOREACH debit_type IN debit_types %] > type_fees['[% debit_type.code | html %]'] = "[% IF debit_type.default_amount %][% debit_type.default_amount | $Price on_editing => 1 %][% END %]"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >index 29c1e31c102..d7e90715618 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-flags.tt >@@ -125,7 +125,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > > [% IF disable_superlibrarian_privs && patron.is_superlibrarian %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >index 83b5a20fbe9..629f8c7f937 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member-password.tt >@@ -125,7 +125,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function generate_password() { > // Always generate a strong password > var chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt >index e81b6aedd2d..3fa802ebda7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/member.tt >@@ -184,7 +184,7 @@ > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/members-patron-selections.js") | $raw %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#merge-patrons, #batch-mod-patrons").prop("disabled", true); > $("#memberresultst").on("change", "input.selection", function () { >@@ -343,7 +343,7 @@ > } > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // Apply DataTables on the results table > var table_settings = [% TablesSettings.GetTableSettings( 'members', 'member', 'memberresultst', 'json' ) | $raw %]; > [% UNLESS CAN_user_borrowers_edit_borrowers OR CAN_user_tools_manage_patron_lists %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >index 561b0d9aa0a..18a5600875e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/memberentrygen.tt >@@ -1614,7 +1614,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function update_cardnumber_warning(size){ > var max_len = [% maxlength_cardnumber | html %]; > if ( size >= max_len ) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt >index 8fedb2db77e..eff0e3c7376 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/members-update.tt >@@ -271,7 +271,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > [%- IF ( active ) -%] > $("#panel-" + [% active | html %] + "_panel").collapse("show"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/merge-patrons.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/merge-patrons.tt >index c912466d4e7..43f89a76128 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/merge-patrons.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/merge-patrons.tt >@@ -15,7 +15,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > ins { > background-color: #e6ffe6; > } >@@ -325,7 +325,7 @@ > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/members-patron-selections.js") | $raw %] > [% Asset.js("lib/jsdiff/jsdiff.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var controls = $("#merge-patrons, #compare_patrons"); > controls.prop("disabled", true); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt >index d813a00c951..27e3b480c33 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember-print.tt >@@ -18,7 +18,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .pager div.dt-buttons { > justify-content: flex-start; > } >@@ -172,7 +172,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'slip-print.inc' #printThenClose %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var checkouts_columns = [% TablesSettings.GetTableSettings( 'circ', 'print_summary', 'print-summary-checkouts', 'json' ) | $raw %]; > var holds_columns = [% TablesSettings.GetTableSettings( 'circ', 'print_summary', 'print-summary-holds', 'json' ) | $raw %]; > var fines_columns = [% TablesSettings.GetTableSettings( 'circ', 'print_summary', 'print-summary-fines', 'json' ) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >index cc59617307f..b906e7b5d20 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/moremember.tt >@@ -799,7 +799,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] > [% PROCESS 'modal-claims-js' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > /* Set some variable needed in circulation.js */ > var logged_in_user_borrowernumber = "[% logged_in_user.borrowernumber | html %]"; > var ClaimReturnedLostValue = "[% Koha.Preference('ClaimReturnedLostValue') | html %]"; >@@ -838,7 +838,7 @@ > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/recalls.js") | $raw %] > [% Asset.js("js/hold-group.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const LoadCheckoutsTableDelay = 0; > const AlwaysLoadCheckoutsTable = [% Koha.Preference('AlwaysLoadCheckoutsTable') | html %]; > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt >index 4b59bec2721..8d03b73701a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/notices.tt >@@ -175,7 +175,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#noticestable").kohaTable({ > order: [[3, "desc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >index 903e6ed1072..73326692435 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/pay.tt >@@ -233,7 +233,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function enableCheckboxActions(){ > // Enable/disable controls if checkboxes are checked > var checkedBoxes = $("input.cb:checked"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >index ca44e9104dc..afa081341d8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/paycollect.tt >@@ -443,7 +443,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% Asset.js("js/additional-fields-entry.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF payment_id && Koha.Preference('FinePaymentAutoPopup') %] > window.open('/cgi-bin/koha/members/printfeercpt.pl?action=print&accountlines_id=[% payment_id | html %]&change_given=[% change_given | html %]&borrowernumber=[% patron.borrowernumber | html %]', '_blank'); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt >index ad315857163..bb6282a7995 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printfeercpt.tt >@@ -17,7 +17,7 @@ > <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | url %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" /> > > [% Asset.css("css/printreceiptinvoice.css") | $raw %] <!-- prettier-ignore-start --> >-[% IF style %]<style>[% style | $raw %]</style>[% END %] >+[% IF style %]<style nonce="[% Koha.CSPNonce | $raw %]">[% style | $raw %]</style>[% END %] > <!-- prettier-ignore-end --> > [% INCLUDE 'blocking_errors.inc' %] > </head> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt >index 759a360acd0..a1bfa292189 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printinvoice.tt >@@ -17,7 +17,7 @@ > <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | url %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" /> > > [% Asset.css("css/printreceiptinvoice.css") | $raw %] <!-- prettier-ignore-start --> >-[% IF style %]<style>[% style | $raw %]</style>[% END %] >+[% IF style %]<style nonce="[% Koha.CSPNonce | $raw %]">[% style | $raw %]</style>[% END %] > <!-- prettier-ignore-end --> > [% INCLUDE 'blocking_errors.inc' %] > </head> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printnotice.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printnotice.tt >index 95bb4634514..edf0615bb5e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/printnotice.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/printnotice.tt >@@ -20,7 +20,7 @@ > <link rel="stylesheet" type="text/css" href="[% Koha.Preference('SlipCSS') | $raw %]" /> > [% END %] > <!-- prettier-ignore-start --> >-[% IF style %]<style>[% style | $raw %]</style>[% END %] >+[% IF style %]<style nonce="[% Koha.CSPNonce | $raw %]">[% style | $raw %]</style>[% END %] > <!-- prettier-ignore-end --> > </head> > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >index c2002d651fc..bbc5380bce7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/purchase-suggestions.tt >@@ -133,7 +133,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#suggestions").kohaTable({ > paging: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt >index 28bcfa0424b..393918ef632 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/readingrec.tt >@@ -163,7 +163,7 @@ > [% INCLUDE 'modals/checkout_renewals.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% Asset.js("js/checkout_renewals_modal.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF Koha.Preference('RecordStaffUserOnCheckout') %] > // FIXME This cannot work without bKohaColumnsUseNames >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >index b9dcb7a1996..35b95cae149 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/statistics.tt >@@ -102,7 +102,7 @@ > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#statistics").kohaTable({ > dom: "t", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >index 942740d3ff3..96cedf9b0ac 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt >@@ -110,7 +110,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#enable-2FA").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt >index 709099449cd..8ad812692cf 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/update-child.tt >@@ -63,7 +63,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#catst").kohaTable({ > dom: "t", >@@ -80,7 +80,7 @@ > }); > </script> > [% IF ( SUCCESS ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > self.opener.location.href='/cgi-bin/koha/members/moremember.pl?borrowernumber=[% borrowernumber | html %]'; > window.close(); > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt >index b285cf113ab..3340f272c5f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/list.tt >@@ -107,7 +107,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#CheckNone").click(function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt >index 633ec8c6c9d..5d238ceb0e4 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/offline_circ/process_koc.tt >@@ -115,7 +115,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/file-upload.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var xhr; > $(document).ready(function () { > $("#enqueuefile").hide(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt >index 3646995cb25..277afdcfaba 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/list.tt >@@ -14,7 +14,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #add_patrons_by_search { > display: none; > } >@@ -234,7 +234,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > $('#patrons_to_add_fieldset').hide(); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt >index dc12d58ba98..daab37f7235 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/lists.tt >@@ -162,7 +162,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > var patronExportModal = $("#patronExportModal"); > var patronExportModalBody = $("#patronExportModal .modal-body"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/patron-lists-tab.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/patron-lists-tab.tt >index 38dac966f47..21c0f68ad2f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/patron-lists-tab.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patron_lists/patron-lists-tab.tt >@@ -120,7 +120,7 @@ > <a onclick="addToList()"><i class="fa fa-plus"></i></a> > </div> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var patron_lists_dt_params = { > sPaginationType: "full", > }; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt >index bcbed141cdf..0d3ecac1575 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-batch.tt >@@ -175,7 +175,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function DeleteConfirm() { > var msg = _("Are you sure you want to delete batch %s?").format("[% batch_id | html %]"); > var answer = confirm(msg); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >index c4c9c658147..ad21844f2b9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-layout.tt >@@ -482,7 +482,7 @@ > [% END %] > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var selectedUnit = $("#units option:selected").val(); > var unitfields = $("#font_size,#field_1_llx,#field_1_lly,#field_2_llx,#field_2_lly,#field_3_llx,#field_3_lly,#barcode_Tx,#barcode_Ty,#image_1_Dx,#image_1_Tx,#image_1_Ty,#image_2_Dx,#image_2_Tx,#image_2_Ty"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >index 75807c94cd5..3972a16463a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-profile.tt >@@ -118,7 +118,7 @@ > [% END %] > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var selectedUnit = $("#units option:selected").val(); > var unitfields = $("#offset_horz,#offset_vert,#creep_horz,#creep_vert"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >index 2b2f6b52cd4..ab313a20752 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/edit-template.tt >@@ -168,7 +168,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var selectedUnit = $("#units option:selected").val(); > var unitfields = $("#page_height,#page_width,#card_width,#card_height,#top_margin,#left_margin,#col_gap,#row_gap"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >index 077eaadc194..e96f540f8d2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/image-manage.tt >@@ -154,7 +154,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function DeleteConfirm() { > var results = selected_images(); > if (results) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt >index e5a0917e0cb..102ff03e069 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/patroncards/manage.tt >@@ -188,7 +188,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function DeleteConfirm() { > var element_ids = selected_layouts("delete"); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >index 028c15b6f71..eabe25a97c0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/plugins/plugins-home.tt >@@ -311,7 +311,7 @@ > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".uninstall_plugin").on("click", function () { > $(".dropdown").removeClass("open"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >index f5cb9b2dd03..712ccc58e3d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/pay.tt >@@ -248,7 +248,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'format_price.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function moneyFormat(textObj) { > var newValue = textObj.value; > var decAmount = ""; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/printreceipt.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/printreceipt.tt >index 53c8b56a851..c131bee6d1b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/printreceipt.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/printreceipt.tt >@@ -16,7 +16,7 @@ > <link rel="shortcut icon" href="[% IF ( IntranetFavicon ) %][% IntranetFavicon | url %][% ELSE %][% interface | html %]/[% theme | html %]/img/favicon.ico[% END %]" type="image/x-icon" /> > > [% Asset.css("css/printreceiptinvoice.css") | $raw %] <!-- prettier-ignore-start --> >-[% IF style %]<style>[% style | $raw %]</style>[% END %] >+[% IF style %]<style nonce="[% Koha.CSPNonce | $raw %]">[% style | $raw %]</style>[% END %] > <!-- prettier-ignore-end --> > [% INCLUDE 'blocking_errors.inc' %] > </head> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >index f6187dfac56..59fa22cc548 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/register.tt >@@ -445,7 +445,7 @@ > [% Asset.js("js/cashup_modal.js") | $raw %] > [% Asset.js("js/modal_printer.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var sales_table = $("#sales").kohaTable({ > orderFixed: [ 0, 'asc'], > ordering: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >index 4c34a41dcde..2936526f6b0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/pos/registers.tt >@@ -216,7 +216,7 @@ > [% INCLUDE 'js-date-format.inc' %] > [% Asset.js("js/cashup_modal.js") | $raw %] > [% Asset.js("js/modal_printer.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > > [%# js used here as we don't have access to these template variables where we need them #%] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/preservation/home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/preservation/home.tt >index fffc41d5b12..e1a03992493 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/preservation/home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/preservation/home.tt >@@ -24,7 +24,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'js-date-format.inc' %] > [% INCLUDE 'js-biblio-format.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const authorised_value_categories = [% To.json(AuthorisedValues.GetCategories()) | $raw %].map(c => c.category); > const db_columns = [% To.json(db_columns) | $raw %]; > const api_mappings = [% To.json(api_mappings) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt >index dba569bc1df..c2a8569d4a6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_to_pull.tt >@@ -149,7 +149,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#recalls-table").kohaTable({ > pagingType: "full_numbers", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt >index b17717d23de..b26dee91bde 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/recalls/recalls_waiting.tt >@@ -154,7 +154,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#recallswaiting-table, #recallsover-table").kohaTable({ > autoWidth: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt >index 1c9f4f4e973..1192c6f439b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/borrowers_stats.tt >@@ -21,7 +21,7 @@ > > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt >index dc10781e512..6703f33af3f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/cash_register_stats.tt >@@ -201,7 +201,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > actTotal = ""; > $(document).ready(function () { > $("#tbl_cash_register_stats").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt >index 2ed7efd37dd..f75f22be30b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_out.tt >@@ -11,7 +11,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt >index c49ebfccd2b..ec104bf7311 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/catalogue_stats.tt >@@ -383,7 +383,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function changeRemovedDateTrStatus() { > var Cellvalue = $("input[name='Cellvalue']:checked").val(); > if(Cellvalue == "deleteditems") { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt >index 7cdfaf7e66b..0100bbf5a49 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/dictionary.tt >@@ -10,7 +10,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows table { > clear: none; > margin: 0; >@@ -336,7 +336,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_CONFIRM_DELETE = _("Are you sure you want to delete this dictionary definition? This cannot be undone."); > > $(document).ready(function () { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >index 17d306491dd..78d9760ec2c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/guided_reports_start.tt >@@ -79,7 +79,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("lib/codemirror/codemirror.min.css") | $raw %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .CodeMirror { > resize: vertical; > } >@@ -1770,7 +1770,7 @@ > [% Asset.css("lib/codemirror/highlight.css") | $raw %] > [% Asset.js( "js/mana.js" ) | $raw %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // if the report param form has multiselects override default form submission > if( $('#report_param_form').find('select[multiple]').length ) { > $('#report_param_form').on('submit', function(e) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt >index c4d9bf34a5b..4bdf80f703d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/issues_stats.tt >@@ -20,7 +20,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt >index 8f87e2161bf..1f1344557ef 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemslost.tt >@@ -193,7 +193,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > var table_settings = [% TablesSettings.GetTableSettings( 'reports', 'lostitems', 'lostitems-table', 'json' ) | $raw %]; > [% IF csv_profiles.count %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt >index 05ef1a3ed1c..1630f2bc634 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/itemtypes.tt >@@ -100,7 +100,7 @@ > [% MACRO jsinclude BLOCK %] > [% IF ( do_it ) %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#itemtypest").kohaTable({ > dom: "t", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt >index b2e0042fcbc..ca1ec276b4d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/orders_by_budget.tt >@@ -168,7 +168,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings( 'reports', 'orders_by_fund', 'funds-table', 'json' ) | $raw %]; > $(document).ready( function () { > var funds_table = $("#funds").kohaTable( >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt >index 1bf8beef1f3..65c25d4da2f 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/reserves_stats.tt >@@ -15,7 +15,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >@@ -397,7 +397,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // Undo the selection that Branches.all made, since there may be no item with homebranch or holdingbranch > $("#holdingbranch option").prop("selected", false); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt >index cbdc39dfe9e..4cfefd2b4de 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reports/serials_stats.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .sql { > display: none; > } >@@ -145,7 +145,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#resulttable").kohaTable({ > paging: false, >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >index 18056f0b06c..6562a6d40ef 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reserve/request.tt >@@ -39,7 +39,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > a.hold-arrow { > display: inline-block; > padding: 3px; >@@ -1612,7 +1612,7 @@ > [% IF multi_hold %] > [% SET url_biblio_params = url_biblio_params _ "&multi_hold=1" %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > hold_table_settings = [% TablesSettings.GetTableSettings( 'circ', 'holds', 'patron_holds_table', 'json' ) | $raw %]; > $("#patron_holds_table").kohaTable( >@@ -2073,20 +2073,20 @@ > }) > }); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > table_settings = [% TablesSettings.GetTableSettings( 'circ', 'circulation', 'table_borrowers', 'json' ) | $raw %]; > </script> > [% UNLESS patron %] > [% SET search_results_block_id = 'holds_patronsearch_pane_panel' %] > [%# adjusting variable for patron-search.inc %] > [% PROCESS patron_search_js table_id => 'table_borrowers', categories => categories, libraries => libraries, columns => columns, open_on_row_click => 1, on_click_url => '/cgi-bin/koha/reserve/request.pl?' _ url_biblio_params, redirect_if_one_result => 1, redirect_url => '/cgi-bin/koha/reserve/request.pl?' _ url_biblio_params, redirect_if_attribute_equal => 'cardnumber' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#holds_patronsearch").on("submit", filter); > }); > </script> > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(".printholdslip").click(function () { > var reserve_id = $(this).attr("data-reserve_id"); > window.open("/cgi-bin/koha/circ/hold-transfer-slip.pl?reserve_id=" + reserve_id); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt >index 051d46433aa..a21ae12da14 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/reviews/reviewswaiting.tt >@@ -131,7 +131,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".delete-comment").on("click", function () { > return confirm(_("Are you sure you want to delete this comment?")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt >index cc797399c36..9f723826278 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/acqui-search-result.tt >@@ -56,7 +56,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function GetIt(aqbooksellerid, name) { > opener.document.f.aqbooksellerid.value = aqbooksellerid; > opener.document.f.aqbooksellername.value = name; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt >index aff38a1c2d5..7ab11e17562 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/checkexpiration.tt >@@ -139,7 +139,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".renew_subscription").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt >index 203707b1d1b..a1989a04ef8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/claims.tt >@@ -217,7 +217,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var sTable; > $(document).ready(function () { > enableSelectedActions(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/result.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/result.tt >index 85d02f12a60..f51f8593270 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/result.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/result.tt >@@ -69,7 +69,7 @@ > <!-- /.main.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".select_title").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview-slip.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview-slip.tt >index 3f95a1ba75b..b7c3e07004d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview-slip.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview-slip.tt >@@ -11,7 +11,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style media="print"> >+<style nonce="[% Koha.CSPNonce | $raw %]" media="print"> > #ser_routing-preview-slip { > min-width: 0; > width: auto; >@@ -72,7 +72,7 @@ > <!-- /.container-fluid --> > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#print_slip").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt >index 9b62a615446..b9a673fe3ed 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing-preview.tt >@@ -78,7 +78,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#save_and_preview_form").on("submit", function (e) { > var myurl = "routing-preview.pl?op=print&subscriptionid=" + $("#subscriptionid").val() + "&issue=" + $("#issue_escaped").val(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt >index 75b52d9b032..6798bbe6b76 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/routing.tt >@@ -135,7 +135,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".itemrank").on("change", function () { > var subscriptionid = $(this).data("subscriptionid"); >@@ -170,7 +170,7 @@ > [% SET columns = ['cardnumber','name','category','branch','action'] %] > [% PROCESS patron_search_modal columns => columns, modal_title => t("Add recipients") %] > [% PROCESS patron_search_js columns => columns, actions => ["add"], preview_on_name_click => 1 %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).on( > "hidden.bs.modal", > "#patron_search_modal", >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt >index 74b3e15a84b..b5f96143e41 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-collection.tt >@@ -341,11 +341,11 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var subscriptionid = "[% subscriptionid | html %]"; > </script> > [% Asset.js("js/serials-toolbar.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function deleteIssues(subscriptionid) { > var serialschecked = $("form[name='edition'] input[name='serialid']:checked"); > if (serialschecked.length > 0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt >index b7e742623b9..a407aeccede 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-edit.tt >@@ -16,7 +16,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.js("js/cataloging.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > //<![CDATA[ > $(document).ready(function () { > $("#multi_receiving").on("show", function () { >@@ -89,7 +89,7 @@ > }); > //]]> > </script> >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #serials_edit fieldset.rows label, > #serials_edit fieldset.rows span.label { > font-size: 100%; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-home.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-home.tt >index f00c053aa5f..8e427c22e46 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-home.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-home.tt >@@ -45,7 +45,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% Asset.js("js/serials-toolbar.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var subscriptionid = "[% subscriptionid | html %]"; > </script> > [% END %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt >index fe5eb4de851..6cd757259f9 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/serials-search.tt >@@ -15,7 +15,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > input.dt-filter { > width: 100%; > font-size: 85%; >@@ -281,11 +281,11 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var subscriptionid = "[% subscriptionid | html %]"; > </script> > [% Asset.js("js/serials-toolbar.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function itemSelectionBuildEditLink( tab ) { > var subscription_ids = new Array(); > $( "input:checkbox." + tab + ":checked" ).each(function() { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >index b1f3b46b63c..3bb2e252fe7 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-add.tt >@@ -19,7 +19,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows li.radio { > width: 100%; > } /* override staff-global.css */ >@@ -596,7 +596,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/mana.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var subscriptionid = "[% subscriptionid | html %]"; > var irregularity = "[% irregularity | html %]"; > var more_than_one_serial = "[% more_than_one_serial | html %]"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt >index 6d25533f1ad..979168c23c8 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-detail.tt >@@ -447,14 +447,14 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var subscriptionid = "[% subscriptionid | html %]"; > </script> > [% Asset.js("js/serials-toolbar.js") | $raw %] > [% Asset.js("js/mana.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("lib/jquery/plugins/treetable/jquery.treetable.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // the english words used in display purposes > var text = new Array(_("Number"),_("Volume"),_("Issue"),_("Month"),_("Week"),_("Starting with:"),_("Rollover at:"),_("Choose hemisphere:"),_("Northern"),_("Southern", > "Autumn"),_("Winter"),_("Spring"),_("Summer"),_("Fall"),_("Season"),_("Year")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt >index f04af733470..14eb12425df 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-frequencies.tt >@@ -198,7 +198,7 @@ > [% END %] > > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function confirmDelete() { > return confirm(_("Are you sure you want to delete this subscription frequency?")); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt >index 82b79e1ed9e..c9908640b64 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-numberpatterns.tt >@@ -330,7 +330,7 @@ > [% END %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function confirmDelete() { > return confirm(_("Are you sure you want to delete this numbering pattern?")); > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt >index df8b47a6469..89d55a116c1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/serials/subscription-renew.tt >@@ -124,7 +124,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".close").on("click", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/sip2/sip2.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/sip2/sip2.tt >index 680ebdce1ca..c4fa32ac1fa 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/sip2/sip2.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/sip2/sip2.tt >@@ -18,7 +18,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const institutions_table_settings = [% TablesSettings.GetTableSettings( 'sip2', 'institutions', 'institutions', 'json' ) | $raw %]; > const accounts_table_settings = [% TablesSettings.GetTableSettings( 'sip2', 'accounts', 'accounts', 'json' ) | $raw %]; > const system_preference_overrides_table_settings = [% TablesSettings.GetTableSettings( 'sip2', 'system_preference_overrides', 'system_preference_overrides', 'json' ) | $raw %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >index ad235d56fac..28e3aa5d047 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/suggestion/suggestion.tt >@@ -31,7 +31,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% IF op == 'else' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > h4.local_collapse a { > font-size: 80%; > text-decoration: none; >@@ -1251,7 +1251,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function select_manager(borrowernumber, borrower) { > let tab = $('#suggestiontabs .active table').data('tab-name'); > if ( tab ) { >@@ -1326,7 +1326,7 @@ > }); > </script> > [% IF ( op == 'show' || op == 'else' ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".deletesuggestion").on("click", function () { > return confirm(_("Are you sure you want to delete this suggestion?")); >@@ -1336,7 +1336,7 @@ > [% END %] > [% IF op == 'else' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF suggestions.size %] > let suggestionData = [% To.json(suggestions) | $raw %]; >@@ -1652,7 +1652,7 @@ > </script> > [% END %] > [% IF op == 'save' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > calcNewsuggTotal(); > $("#quantity,#price,#currency").on("change",function(){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt >index 60d1bc4e330..6fd33903e31 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/list.tt >@@ -13,7 +13,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > tr.selected { > background-color: #ffffcc; > } >@@ -151,7 +151,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".delete").click(function (event) { > $(this).parent().parent().parent().addClass("selected"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt >index cc6c5efd168..46465b5a16b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tags/review.tt >@@ -23,7 +23,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .setlabel { > background-color: #e8e8e8; > font-family: courier; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/access_files.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/access_files.tt >index ef2a8ddeb7a..c233e05ea62 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/access_files.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/access_files.tt >@@ -65,7 +65,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#files").kohaTable({ > columnDefs: [{ targets: [-1], orderSequence: ["desc", "asc"], searchable: false }], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt >index 68eea231805..9ce8d1f1125 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/additional-contents.tt >@@ -58,7 +58,7 @@ > [% SET editmode = "text" %] > [% Asset.css("lib/codemirror/codemirror.css") | $raw %] > [% Asset.css("lib/codemirror/lint.min.css") | $raw %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .CodeMirror { > resize: vertical; > z-index: 0; >@@ -68,7 +68,7 @@ > [% IF category == 'record_display' %] > [% editmode = "text" %] > [% END %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .syspref-link::before { > content: " | "; > } >@@ -597,7 +597,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'select2.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#saveandcontinue").on("click", function (e) { > e.preventDefault(); > $("#redirect").val("just_save"); >@@ -606,7 +606,7 @@ > </script> > [% IF additional_contents.count %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(".preview_news").click(function () { > modalNumber = $(this).attr("data-number"); > $('.modal[data-number="' + modalNumber + '"]').modal("show"); >@@ -684,7 +684,7 @@ > }); > </script> > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function showLocationNotes( location ){ > $(".customization_note").hide(); > $( "#" + location + "_notes" ).show(); >@@ -736,7 +736,7 @@ > [% Asset.js( "lib/codemirror/lint.min.js" ) | $raw %] > [% Asset.js( "lib/linters/htmlhint.min.js" ) | $raw %] > [% Asset.js( "lib/codemirror/html-lint.min.js" ) | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let editors = new Object(); /* Keeps track of initialized CodeMirror instances */ > $(document).ready(function () { > if ($("#tabs .tab-pane.active").length < 1) { >@@ -775,7 +775,7 @@ > [% ELSE %] > [% Asset.js("lib/tiny_mce/tinymce.min.js") | $raw %] > [% INCLUDE 'str/tinymce_i18n.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > if( $("#tabs").length > 0 && $("#tabs .tab-pane.active").length < 1 ){ > /* Activate first tab and initialize its tinyMCE instance */ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt >index 07c1d71ced0..c85fff1f714 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/automatic_item_modification_by_age.tt >@@ -272,7 +272,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/automatic_item_modification_by_age.js") | $raw %] > [% IF op == 'edit_form' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF rules.size > 0 %] > $("#norules").hide(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt >index 422c665cf51..15aa2ad75db 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-del.tt >@@ -22,7 +22,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > <!--[if IE]> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #selections { > display: none; > } >@@ -236,7 +236,7 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/pages/batchMod.js") | $raw %] > [% Asset.js("js/browser.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF searchid %] > browser = KOHA.browser('[% searchid | html %]'); > browser.show_back_link(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >index 1d5511c9a49..7bf4e662fd1 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batchMod-edit.tt >@@ -21,7 +21,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > input[type="checkbox"] { > margin: 0 0.5em; > } >@@ -296,7 +296,7 @@ > [% Asset.js("js/pages/batchMod.js") | $raw %] > [% INCLUDE 'select2.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // Prepare array of all column headers, incrementing each index by > // two to accommodate control and title columns > var allColumns = new Array([% FOREACH item_header_loo IN item_header_loop %]'[% loop.count | html %]'[% UNLESS ( loop.last ) %],[% END %][% END %]); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >index 1bfd843ed77..eceaf08950d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_delete_records.tt >@@ -263,7 +263,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_CANNOT_BE_DELETED = _("This record cannot be deleted, at least one item is currently checked out."); > $(document).ready(function() { > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt >index 26787e4662a..5d9c617a9f3 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_extend_due_dates.tt >@@ -250,7 +250,7 @@ > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'select2.inc' %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#selectall").click(function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt >index de32ade2238..f75fa8dc37a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_modify_holds.tt >@@ -245,7 +245,7 @@ > [% INCLUDE 'select2.inc' %] > [% INCLUDE 'js-biblio-format.inc' %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let hide_patron_name = [% IF Koha.Preference('HidePatronName') %]true[% ELSE %]false[% END %]; > let hold_ids = [% IF updated_holds %] [% updated_holds | $raw %] [% ELSE %] [] [% END %]; > let hold_ids_from_sql = [% IF reserve_ids_list %] [% reserve_ids_list | $raw %] [% ELSE %] [] [% END %]; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt >index fc7943ff235..139ab760a63 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/batch_record_modification.tt >@@ -319,7 +319,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function update_tab_display(){ > let selected_type = $('input[name="recordtype"]:checked').val(); > if (selected_type == 'authority') { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt >index ade9a6ca0bd..59ef3fe5c42 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/cleanborrowers.tt >@@ -263,7 +263,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $("#delete_patrons_form").on("submit",function(){ > return checkForm( this ); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >index f6b3ee976ba..b656d2feb09 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/csv-profiles.tt >@@ -355,7 +355,7 @@ > > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function reloadPage(p) { > var id = p.value; > if (id != 0) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt >index 10afc5c9be6..83c6f262e6a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/export.tt >@@ -12,7 +12,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows li { > display: flex; > } >@@ -329,7 +329,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'select2.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > const output_format = $("#output_format"); > const csv_profiles = $("li.csv_profiles"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt >index bfd0e3e50a6..7c5971fc52a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/holidays.tt >@@ -425,7 +425,7 @@ > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var weekdays = new Array(_("Sundays"),_("Mondays"),_("Tuesdays"),_("Wednesdays"),_("Thursdays"),_("Fridays"),_("Saturdays")); > > /* Creates all the structures to deal with all different kinds of holidays */ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >index fefcd7a17e8..d3ebd1361b0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/import_borrowers.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > label.description { > width: 20em; > } >@@ -426,7 +426,7 @@ > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [%# Make date fields have the datepicker %] > $("#dateenrolled, #dateexpiry, #dateofbirth").flatpickr({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt >index 00603354510..1ed87b66c2d 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/inventory.tt >@@ -20,7 +20,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .branchgridrow { > display: flex; > flex-wrap: wrap; >@@ -407,7 +407,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function checkForm() { > if ( $('#uploadbarcodes').val() && $('#barcodelist').val() ) { > alert(_("You have uploaded a barcode file and scanned barcodes at the same time. Please choose one of the two options.")); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >index 6ec0ce10799..196852d458e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/letter.tt >@@ -36,7 +36,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #preview_template .modal-dialog { > width: 80%; > } >@@ -845,7 +845,7 @@ > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("lib/jquery/plugins/jquery.insertatcaret.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var no_op_set = '[% no_op_set | html %]'; > var interface = '[% interface | html %]'; > var theme = '[% theme | html %]'; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >index e1cd0540459..5c1a698e7b0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/manage-marc-import.tt >@@ -21,7 +21,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/humanmsg.css") | $raw %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > span.change-status { > font-style: italic; > color: #666; >@@ -457,7 +457,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("lib/jquery/plugins/humanmsg.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > $("#staged-record-matching-rules select").change(function() { > var str = $(this).attr("id"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt >index 48089fc10eb..d4be2ef383a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/marc_modification_templates.tt >@@ -25,7 +25,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #add_action { > display: none; > } >@@ -379,7 +379,7 @@ > > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > table_settings = [% TablesSettings.GetTableSettings('tools', 'marc-modification-templates', 'templatest', 'json') | $raw %]; > [% IF ActionsLoop %] > var mmtas = [% ActionsLoop.json | $raw %] >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt >index 8a96bdb1c3d..d86f73b319c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/modborrowers.tt >@@ -481,7 +481,7 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% Asset.js("js/members-patron-selections.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var patron_attributes_lib = new Array(); > var patron_attributes_values = new Array(); > >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt >index dd8b23ddbcc..9f93de2743e 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/overduerules.tt >@@ -175,7 +175,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var tab_map = { 0: _("First"), 1: _("Second"), 2: _("Third") }; > $(document).ready(function () { > $("#selectlibrary").find("input:submit").hide(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >index de2cb82848a..11f7e7263a0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/picture-upload.tt >@@ -202,7 +202,7 @@ > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'str/members-menu.inc' %] > [% Asset.js("js/members-menu.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#zipfile").click(function () { > $("#cardnum").hide(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt >index 405ef4bad53..fc751a2d2c0 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/problem-reports.tt >@@ -140,7 +140,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#problemreportstable").kohaTable({ > order: [[1, "asc"]], >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >index 3897dfef959..29674428dde 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes-upload.tt >@@ -92,7 +92,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let table_dt; //DataTable object > $(document).ready(function () { > $("#cancel_upload").on("click", function (e) { >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt >index 7708bb4b3c4..9fcc03673de 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/quotes.tt >@@ -169,7 +169,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var quotes_url = "/api/v1/quotes"; > var quotes = $("#quotes").kohaTable({ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt >index 5e578c2a657..c737b961ef2 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/scheduler.tt >@@ -122,7 +122,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#starttime").on("blur", function () { > var time = $(this).val(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/showdiffmarc.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/showdiffmarc.tt >index 55aef0bcbd7..f270985e841 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/showdiffmarc.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/showdiffmarc.tt >@@ -11,7 +11,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > ins { > background-color: #e6ffe6; > } >@@ -95,7 +95,7 @@ > [% MACRO jsinclude BLOCK %] > [% Asset.js("js/tools-menu.js") | $raw %] > [% Asset.js("lib/jsdiff/jsdiff.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > var diff1 = $("#col1 pre").text(); > var diff2 = $("#col2 pre").text(); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt >index e42fde81c6b..34018a4606b 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stage-marc-import.tt >@@ -15,7 +15,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #fileuploadstatus, > #fileuploadfailed, > #fileuploadcancel { >@@ -264,7 +264,7 @@ > > [% INCLUDE 'str/job_progress.inc' job_id=job_id %] > [% Asset.js("js/job_progress.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var xhr; > var PROFILE_SAVE_MSG = _("Profile saved"); > var PROFILE_DEL_MSG = _("Profile deleted"); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >index 7735f0a55f9..8ff4a1e52aa 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/stockrotation.tt >@@ -36,7 +36,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > i.drag_handle { > color: #999; > } >@@ -719,7 +719,7 @@ > [% INCLUDE 'datatables.inc' %] > [% Asset.js( "lib/sortable/Sortable.min.js" ) | $raw %] > [% Asset.js("js/pages/stockrotation.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var stock_rotation_items_table_settings = [% TablesSettings.GetTableSettings( 'tools', 'stockrotation', 'stock_rotation_manage_items', 'json' ) | $raw %]; > var stock_rotation_table_settings = [% TablesSettings.GetTableSettings( 'tools', 'stockrotation', 'stock_rotation', 'json' ) | $raw %]; > $("#addStageModal, #addItemsModal").on("shown.bs.modal", function(){ >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt >index b4400967877..d826861459a 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload-images.tt >@@ -17,7 +17,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #fileuploadstatus, > #fileuploadfailed, > #jobpanel, >@@ -310,7 +310,7 @@ > <!-- /.row --> > [% END %] > [% MACRO jsinclude BLOCK %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var interface = "[% interface | html %]"; > var theme = "[% theme | html %]"; > var biblionumber = "[% biblionumber | html %]"; >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt >index 00d5862a3e2..333d12479b6 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/upload.tt >@@ -248,7 +248,7 @@ > <!-- /.page-section --> > [% END %] > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > #fileuploadstatus, > #fileuploadfailed { > display: none; >@@ -360,7 +360,7 @@ > [% Asset.js("js/tools-menu.js") | $raw %] > [% INCLUDE 'datatables.inc' %] > [% Asset.js("js/file-upload.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function StartUpload() { > if( $('#fileToUpload').prop('files').length == 0 ) return; > $('#fileToUpload').prop('disabled',true); >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt >index 42634a034e8..2e2b903eb79 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/tools/viewlog.tt >@@ -21,7 +21,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% Asset.css("css/humanmsg.css") | $raw %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows label.viewlog { > float: none; > font-weight: normal; >@@ -471,7 +471,7 @@ > [% Asset.js("js/members-menu.js") | $raw %] > [% END %] > [% Asset.js("lib/jsdiff/jsdiff.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var table_settings = [% TablesSettings.GetTableSettings('tools', 'logviewer', 'logst', 'json') | $raw %]; > var CAN_user_parameters_manage_sysprefs = "[% CAN_user_parameters_manage_sysprefs | html %]"; > </script> >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >index c4a99d8363f..9b46d400fb5 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/addbybiblionumber.tt >@@ -8,7 +8,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset.rows { > float: none; > } >diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >index 65047eb133b..6399ad36c0c 100644 >--- a/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/virtualshelves/shelves.tt >@@ -27,7 +27,7 @@ > [% END %]</title > > > [% INCLUDE 'doc-head-close.inc' %] >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > textarea { > width: 100%; > } >@@ -626,7 +626,7 @@ > [% MACRO jsinclude BLOCK %] > [% INCLUDE 'datatables.inc' %] > [% IF print %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > window.print(); > window.onafterprint = function () { >@@ -638,7 +638,7 @@ > }); > </script> > [% END #/print %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var MSG_NO_ITEM_SELECTED = _("Nothing is selected."); > var MSG_REMOVE_FROM_LIST = _("Are you sure you want to remove these records from the list?"); > var MSG_CONFIRM_DELETE_LIST = _("Are you sure you want to remove this list?"); >@@ -959,7 +959,7 @@ > [% END %] > </script> > [% IF op == 'transfer' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > patron_autocomplete($("#find_patron"), { > "on-select-add-to": { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/calendar.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/calendar.inc >index 240fa9953c3..8c7d0dbea8c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/calendar.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/calendar.inc >@@ -1,7 +1,7 @@ > [% USE Asset %] > [% USE Koha %] > [% USE raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var flatpickr_weekdays = { > shorthand: [ "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"], > longhand: [ "Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday" ] >@@ -60,7 +60,7 @@ > [% Asset.js("lib/flatpickr/flatpickr.min.js") | $raw %] > [% Asset.js("lib/maskito/maskito.core.js") | $raw %] > [% Asset.js("lib/maskito/maskito.kit.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > flatpickr.l10ns.default.weekdays = flatpickr_weekdays; > flatpickr.l10ns.default.months = flatpickr_months; > flatpickr.setDefaults({ >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >index 38ed441b4a0..03ae9407b5a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/doc-head-close.inc >@@ -48,12 +48,12 @@ > [% END %] > [% IF ( Koha.Preference('OPACUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('OPACUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('OPACUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] > <!-- prettier-ignore-start --> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > [% Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) | $raw %] > </style> > <!-- prettier-ignore-end --> >@@ -62,7 +62,7 @@ > [% SET SCOUserCSS = Koha.Preference('SCOUserCSS') %] > [% IF SCOUserCSS %] > <!-- prettier-ignore-start --> >- <style>[% SCOUserCSS | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% SCOUserCSS | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% END %] >@@ -73,7 +73,7 @@ > [% FILTER collapse %] > [% PROCESS cssinclude %] > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > function _(s) { return s } // dummy function for gettext > const is_logged_in = [% IF logged_in_user %]true[% ELSE %]false[% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/greybox.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/greybox.inc >index 0fc2e18dd93..c851e0581ff 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/greybox.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/greybox.inc >@@ -1,6 +1,6 @@ > [% USE raw %] > [% USE Asset %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var GB_ROOT_DIR = "[% interface | html %]/lib/greybox/"; > </script> > [% Asset.js("lib/greybox/AJS.js") | $raw %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc >index 8f860228b67..c7b38419651 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/create.inc >@@ -135,7 +135,7 @@ > <p>Unknown stage. This should not have happened. </p> > [% END %] > [% BLOCK backend_jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var core = [ [% whole.core | $raw %] ]; > // <![CDATA[] > [% INCLUDE "ill/backends/Standard/shared/shared.js" %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/shared/custom_fields.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/shared/custom_fields.inc >index e49b3832632..bfdc09d97d7 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/shared/custom_fields.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/ill/backends/Standard/shared/custom_fields.inc >@@ -25,7 +25,7 @@ > </button> > </fieldset> > >-<style> >+<style nonce="[% Koha.CSPNonce | $raw %]"> > .custom-field-input { > width: 25%; > display: inline-block; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-biblio-format.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-biblio-format.inc >index 72e37775da6..c93172f44d0 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-biblio-format.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-biblio-format.inc >@@ -1,5 +1,4 @@ >- >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function () { > /** > * Format the biblio response from a Koha RESTful API request. >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-date-format.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-date-format.inc >index 703bb2d5491..11cf7798f3b 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-date-format.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/js-date-format.inc >@@ -5,12 +5,12 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/timezone.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/utc.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_utc); > dayjs.extend(window.dayjs_plugin_timezone); > </script> > <!-- js-date-format.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > (function() { > var def_date_format = '[% Koha.Preference('dateformat') | html %]'; > var def_time_format = '[% Koha.Preference('TimeFormat') | html %]'; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc >index 825846e29af..404b2946fca 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc >@@ -98,7 +98,7 @@ > [% Asset.js("lib/bootstrap/js/bootstrap.bundle.min.js") | $raw %] > [% Asset.js("lib/fontfaceobserver/fontfaceobserver.min.js") | $raw %] > [% Asset.js("lib/enquire/enquire.min.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > let logged_in_user_id = "[% logged_in_user.borrowernumber | html %]"; > </script> > [% Asset.js("js/global.js") | $raw %] >@@ -106,7 +106,7 @@ > [% IF ( OPACAmazonCoverImages || SyndeticsCoverImages ) %] > [% Asset.js("js/amazonimages.js") | $raw %] > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF (query_desc) %] > var query_desc = "[% query_desc | html %]"; > var querystring = "[% querystring | html %]"; >@@ -142,7 +142,7 @@ > [% ELSIF ( Koha.Preference( 'virtualshelves' ) == 1 ) %] > [% Asset.js("js/basket.js") | $raw %] > [% ELSE %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var readCookie; > </script> > [% END %] >@@ -161,7 +161,7 @@ > > [% IF ( BakerTaylorEnabled ) %] > [% Asset.js("js/bakertaylorimages.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(window).load(function () { > bt_verify_images(); > }); >@@ -169,7 +169,7 @@ > [% END %] > > [% IF Koha.Preference( 'OpacNewsLibrarySelect' ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $("#news-branch-select").change(function () { > $("#news-branch-select").submit(); > }); >@@ -178,7 +178,7 @@ > > [% Asset.js("lib/js-cookie/js.cookie-3.0.1.min.js") | $raw %] > [% Asset.js("js/show-password-toggle.js") | $raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > if ($("#searchsubmit").length) { > $(document).on("click", "#searchsubmit", function (e) { >@@ -193,19 +193,19 @@ > [% INCLUDE 'js-biblio-format.inc' %] > [% PROCESS jsinclude %] > [% IF ( Koha.Preference('OPACUserJS') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% Koha.Preference('OPACUserJS') | $raw %] > </script> > [% END %] > [% IF Branches.GetBranchSpecificJS( Branches.GetLoggedInBranchcode() || default_branch) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% Branches.GetBranchSpecificJS( Branches.GetLoggedInBranchcode() || default_branch) | $raw %] > </script> > [% END %] > [% IF SCO_login %] > [% SET SCOUserJS = Koha.Preference('SCOUserJS') %] > [% IF ( SCOUserJS ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% SCOUserJS | $raw %] > </script> > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc >index 24cb8e8b8a3..81e3b020f57 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/password_check.inc >@@ -1,5 +1,5 @@ > [% USE Koha %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var pwd_title = ""; > var pattern_title = ""; > var new_password_node_name = "[% new_password | html %]"; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/slip-print.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/slip-print.inc >index 710ba36b4c2..9c98cc44e83 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/slip-print.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/slip-print.inc >@@ -1,5 +1,5 @@ > [% USE raw %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF ( Koha.Preference('IntranetSlipPrinterJS') ) %] > [% Koha.Preference('IntranetSlipPrinterJS') | $raw %] > [% ELSE %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/includes/validator-strings.inc b/koha-tmpl/opac-tmpl/bootstrap/en/includes/validator-strings.inc >index 80bf3737567..d45abe00ff8 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/includes/validator-strings.inc >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/includes/validator-strings.inc >@@ -1,5 +1,5 @@ > <!-- validator-strings.inc --> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > jQuery.extend(jQuery.validator.messages, { > required: _("This field is required."), >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt >index 0e56b7e112a..a21d8389efb 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/clubs-tab.tt >@@ -66,7 +66,7 @@ > </tbody> > </table> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function loadEnrollmentForm( id ) { > $("body").css("cursor", "progress"); > $('#opac-user-clubs_panel').load('/cgi-bin/koha/clubs/enroll.pl?borrowernumber=[% borrower.borrowernumber | html %]&id=' + id, function() { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt >index 01937f9c78e..98ade5e625d 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/clubs/enroll.tt >@@ -32,7 +32,7 @@ > </fieldset> > </form> > </div> >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > function addEnrollment() { > $("body").css("cursor", "progress"); > let data = $( "#patron-enrollment-form" ).serialize(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/maintenance.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/maintenance.tt >index 223c072202d..5f51f439030 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/maintenance.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/maintenance.tt >@@ -16,7 +16,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .navbar-expand { > justify-content: space-between; > } >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt >index 20d8cb99be7..7fa0f34f022 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-MARCdetail.tt >@@ -197,7 +197,7 @@ > [% IF Koha.Preference('OpacCatalogConcerns') %] > [% Asset.js("js/modals/catalog_concern.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > var loaded = 0; > var toggle = 0; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account.tt >index 75dd67bac33..ccabea1da9a 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-account.tt >@@ -83,7 +83,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $( document ).ready(function() { > > var txtActivefilter = _("Filter paid transactions"); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt >index 4db1b806791..4b47ac012f7 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-addbybiblionumber.tt >@@ -10,7 +10,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > form { > margin-left: 3rem; > } >@@ -188,7 +188,7 @@ > > [% INCLUDE 'opac-bottom.inc' is_popup=1 %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF WINDOW_PARENT_RELOAD %] > opener.location.reload(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >index 39e0ce80041..e445ca63df9 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-advsearch.tt >@@ -14,7 +14,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .adv-search-grid { > display: grid; > gap: 0.5rem; >@@ -525,7 +525,7 @@ > > [% BLOCK jsinclude %] > [% Asset.js("lib/jquery/plugins/jquery.deserialize.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > window.addEventListener('pageshow', function( e ){ > $('.form-control:visible').prop('disabled' , false ); > }); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt >index 2a2a2e5e125..2f464ac9ca2 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-alert-subscriptions.tt >@@ -99,7 +99,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#subscriptions").kohaTable(); > $(".unsubscribe").submit(function () { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-MARCdetail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-MARCdetail.tt >index c56f3cc8e0c..bd6598d313c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-MARCdetail.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-MARCdetail.tt >@@ -95,7 +95,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% Asset.js("lib/jquery/plugins/jstree/jstree-3.3.12.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF ( displayhierarchy ) %] > $('#hierarchies').jstree({ >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-detail.tt >index f9850b00990..f75fec67bea 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-detail.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth-detail.tt >@@ -214,7 +214,7 @@ > [% IF ( displayhierarchy ) %] > [% Asset.js("lib/jquery/plugins/jstree/jstree-3.3.12.min.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF ( displayhierarchy ) %] > $('#hierarchies').jstree({ >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >index 6d6c135cc1a..a75cd071328 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt >@@ -305,7 +305,7 @@ > > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > // Hide circular 'Log in to Your Account' link in opac-auth.pl > $(document).ready(function () { > if ($("#auth")) { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt >index 650524815b6..b19d3a3ed86 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-authoritiessearchresultlist.tt >@@ -119,7 +119,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script type="text/JavaScript"> >+ <script nonce="[% Koha.CSPNonce | $raw %]" type="text/JavaScript"> > $(document).ready(function () { > $(".table").kohaTable({ > searching: false, >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt >index 382bf9727c3..2fac890bd7d 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-basket.tt >@@ -19,7 +19,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .item-status, > .dt-buttons { > display: inline; >@@ -443,7 +443,7 @@ > > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF ( TagsInputEnabled && loggedinusername ) %] > function tagSelected() { > var bibs = document.getElementById('records').value; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >index 7d6d9c19246..2850e85221f 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-details.tt >@@ -138,7 +138,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > table_settings = [% TablesSettings.GetTableSettings( 'opac', 'course_items', 'course-items-table', 'json' ) | $raw %]; > $("#course-items-table").kohaTable( >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >index e168098b262..e5c0572fc10 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-course-reserves.tt >@@ -83,7 +83,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > table_settings = [% TablesSettings.GetTableSettings( 'opac', 'course_list', 'course_reserves_table', 'json' ) | $raw %] > $("#course_reserves_table").kohaTable( >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt >index 87b695a870f..36f8baff2c1 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-curbside-pickups.tt >@@ -16,7 +16,7 @@ > [% END %]</title > > > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .pickup_time input[type="radio"] { > display: none; > } >@@ -280,15 +280,15 @@ > [% Asset.js("lib/dayjs/dayjs.min.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/isSameOrAfter.js") | $raw %] > [% Asset.js("lib/dayjs/plugin/customParseFormat.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_isSameOrAfter); > </script> >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > dayjs.extend(window.dayjs_plugin_customParseFormat); > </script> > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% SET pickup_exists_in = [] %] > [% FOR p IN patron_curbside_pickups %] > [% UNLESS p.delivered_by %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >index 9d432eaa075..c8dd98a4aee 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-detail.tt >@@ -48,7 +48,7 @@ > [% Asset.css("lib/Chocolat/css/chocolat.css") | $raw %] > [% INCLUDE 'doc-head-close.inc' %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .component_part { > padding: 0.5rem 0.9rem; > border-bottom: 1px solid #bcbcbc; >@@ -1640,7 +1640,7 @@ > [% Asset.js("lib/Chocolat/js/chocolat.js") | $raw %] > > [% IF ( Koha.Preference('OPACShowMusicalInscripts') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var interface = "[% interface | html %]"; > var PREF_OPACPlayMusicalInscripts = "[% Koha.Preference('OPACPlayMusicalInscripts') | html %]"; > </script> >@@ -1650,7 +1650,7 @@ > [% IF OpenLibraryCovers || OpenLibrarySearch %] > [% Asset.js("js/openlibrary.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > window.emojiPicker = new EmojiPicker({ > emojiable_selector: '[data-emojiable=true]', > assetsPath: '[% interface | html %]/lib/emoji-picker/img/', >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >index 2add33da39a..0fe68b338b0 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-downloadshelf.tt >@@ -83,7 +83,7 @@ > </fieldset> > </form> > [% IF ( modal ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#userdownloadshelf form").on("submit", function (e) { > if ($("#dlformat").val() == "") { >@@ -115,7 +115,7 @@ > <!-- / .main --> > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#userdownloadshelf form").on("submit", function (e) { > if ($("#dlformat").val() == "") { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-full-serial-issues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-full-serial-issues.tt >index a7b24958a95..6aed1351333 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-full-serial-issues.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-full-serial-issues.tt >@@ -18,7 +18,7 @@ > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] > [% FILTER collapse %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > div.tabsub { > clear: both; > } >@@ -190,7 +190,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > showlayer([% yearmin | html %]); > $("a.tabsubs:first").addClass("currentsubtab"); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt >index 7a835870209..3333a750e70 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-holdshistory.tt >@@ -20,7 +20,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .controls .paginate_button { > font-family: "FontAwesome"; > text-decoration: none; >@@ -191,7 +191,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#sort").change(function () { > $("#sortform").submit(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >index a83df0004b3..85e64052ef4 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-idref.tt >@@ -10,7 +10,7 @@ > <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #idref h2.role { > background-color: #dddeee; > cursor: pointer; >@@ -57,7 +57,7 @@ > </main> > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("table").kohaTable({ > filter: false, >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >index cd17cee4906..b23b632b3e5 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-illrequests.tt >@@ -406,7 +406,7 @@ > > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function display_extended_attribute(row, type) { > var arr = $.grep(row.extended_attributes, ( x => x.type === type )); > if (arr.length > 0) { >@@ -519,7 +519,7 @@ > </script> > [% IF op == 'availability' %] > [% Asset.js("js/ill-availability.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > window.doSearch(); > }); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt >index 0d3263d1aa5..3af596f0c39 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-imageviewer.tt >@@ -15,7 +15,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #largeCoverImg { > border: 1px solid #cccccc; > display: block; >@@ -121,7 +121,7 @@ > > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > $("#largeCoverImg").attr("src","[% interface | html %]/[% theme | html %]/images/loading.gif"); > showCover([% imagenumber | html %]); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-library.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-library.tt >index 1b3f069c2d1..dab55c7f856 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-library.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-library.tt >@@ -21,7 +21,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .section_library { > margin-top: 1rem; > margin-bottom: 1rem; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >index 8a7563c7756..5d16781122e 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-memberentry.tt >@@ -1389,7 +1389,7 @@ > [% INCLUDE 'validator-strings.inc' %] > [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF op == 'edit' && !OPACPatronDetails %] > $("#memberentry-form :input").attr('readonly', true); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >index 7e22a3421ff..edb4db4eeae 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-messaging.tt >@@ -361,7 +361,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > function toggle_digest(id){ > let PhoneNotification = [% Koha.Preference('PhoneNotification') || 0 | html %]; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-overdrive-search.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-overdrive-search.tt >index d5a910f3da3..22c7db2b972 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-overdrive-search.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-overdrive-search.tt >@@ -83,7 +83,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% Asset.js("js/overdrive.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [%- IF Koha.Preference('OverDrivePasswordRequired') -%] > var OD_password_required = 1; > [%- ELSE -%] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt >index da5690bfb22..36970d22fae 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-passwd.tt >@@ -130,7 +130,7 @@ > [% BLOCK jsinclude %] > [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] > [% PROCESS 'password_check.inc' new_password => 'Newkey', minPasswordLength => logged_in_user.category.effective_min_password_length, RequireStrongPassword => logged_in_user.category.effective_require_strong_password %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#mainform").validate({ > rules: { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt >index d96a76c2469..015c5e42415 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt >@@ -21,7 +21,7 @@ > [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] > [% PROCESS 'password_check.inc' new_password => 'newPassword', minPasswordLength => minPasswordLength, RequireStrongPassword => RequireStrongPassword %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(function() { > $("#CheckAll").click(function(){ > $("[name=deleteRequest]").attr('checked', true); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt >index 850b723b6a0..84c0d837a5f 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt >@@ -97,7 +97,7 @@ > > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // Initially no choice is made or no change, so disable button > $("#saveconsent").prop("disabled", true); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt >index 85f083cecbe..6df569e9a86 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-readingrecord.tt >@@ -228,7 +228,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function(){ > [% IF ( GoogleJackets ) %]KOHA.Google.GetCoverFromIsbn();[% END %] > $('#order').change(function() { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >index 9c58aa7343a..9d4eeb94406 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recall.tt >@@ -194,7 +194,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'calendar.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".level-option").show(); > $("#items").hide(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt >index b50e27e943a..f0c29f73344 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-recalls.tt >@@ -137,7 +137,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $(".cancel_recall").click(function () { > return confirmDelete(_("Are you sure you want to remove this recall?")); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt >index 3917b444172..0c927846169 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-request-article.tt >@@ -263,7 +263,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready( function() { > allow_submit = false; > $('#place-article-request').on('submit', function( event ){ >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt >index 630cb96a635..6cb12c6f10c 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reserve.tt >@@ -587,7 +587,7 @@ > [% BLOCK jsinclude %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > > $(".toggle_unholdable").click(function(e){ >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt >index fbadc0fb1c5..d8b48385f20 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-reset-password.tt >@@ -135,7 +135,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% Asset.js("lib/jquery/plugins/jquery.validate.min.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > jQuery.validator.addMethod( > "password_no_spaces", > function (value, element) { >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >index 4034eb9633c..9eddd853086 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-results.tt >@@ -481,14 +481,14 @@ > [% END %] > [% Asset.js("lib/Chocolat/js/chocolat.js") | $raw %] > [% CoverImagePlugins | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const loggedinusername = [% ( loggedinusername ) ? 1 : 0 | html %]; > const opacbookbag = [% ( opacbookbag ) ? 1 : 0 | html %]; > const virtualshelves = [% ( virtualshelves ) ? 1 : 0 | html %]; > </script> > [% Asset.js("js/results-list.js") | $raw %] > [% Asset.js("js/cover_images.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF ( OpacHighlightedWords ) %] > var q_array = new Array(); // holds search terms if available > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt >index 06019a7ce66..44da04017ed 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-review.tt >@@ -89,7 +89,7 @@ > > [% INCLUDE 'opac-bottom.inc' is_popup=1 %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function() { > [% IF WINDOW_CLOSE %] > opener.location.reload(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt >index caaacd96f7b..e22d903faef 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-search-history.tt >@@ -305,7 +305,7 @@ > > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > // We show table ordered by descending dates by default > // (so that the more recent query is shown first) >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt >index d13a8291c79..6312322ad42 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-serial-issues.tt >@@ -16,7 +16,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > .subscriptionline { > border-bottom: 1px solid #eee; > padding: 1em 0; >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt >index 307aba068e0..e3b602a3d37 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shareshelf.tt >@@ -153,7 +153,7 @@ > > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("#share_list").on("submit", function (e) { > var address = $("#invite_address").val(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >index 78629f1e38a..cbcffa82392 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt >@@ -831,14 +831,14 @@ > [% IF OpenLibraryCovers || OpenLibrarySearch %] > [% Asset.js("js/openlibrary.js") | $raw %] > [% END %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const loggedinusername = [% ( loggedinusername ) ? 1 : 0 | html %]; > const opacbookbag = [% ( opacbookbag ) ? 1 : 0 | html %]; > const virtualshelves = [% ( virtualshelves ) ? 1 : 0 | html %]; > </script> > [% Asset.js("js/results-list.js") | $raw %] > [% Asset.js("js/cover_images.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > let counter_wait = 0; > function wait_for_images(cb){ > >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews.tt >index c8d515dc0c4..55ca977843b 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-showreviews.tt >@@ -202,7 +202,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% IF ( GoogleJackets ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > KOHA.Google.GetCoverFromIsbn(); > }); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >index 3f7a68b5937..a9680057184 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-suggestions.tt >@@ -576,7 +576,7 @@ > [% Asset.js("js/autofill.js") | $raw %] > [% END %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% IF ( loggedinusername ) %] > function enableCheckboxActions(){ > // Enable/disable controls if checkboxes are checked >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt >index 4f4ea2c1864..24fab56f5c4 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-tags.tt >@@ -26,7 +26,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > fieldset { > padding: 0.3em; > margin: 0.3em 0; >@@ -249,13 +249,13 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > const loggedinusername = [% ( loggedinusername ) ? 1 : 0 | html %]; > const opacbookbag = [% ( opacbookbag ) ? 1 : 0 | html %]; > const virtualshelves = [% ( virtualshelves ) ? 1 : 0 | html %]; > </script> > [% Asset.js("js/results-list.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(document).ready(function () { > $("body").on("click", ".remove", function (e) { > e.preventDefault(); >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-topissues.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-topissues.tt >index 03f6b1e221b..14ed28c7092 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-topissues.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-topissues.tt >@@ -17,7 +17,7 @@ > > > [% INCLUDE 'doc-head-close.inc' %] > [% BLOCK cssinclude %] >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > #search-facets fieldset { > border: 0; > margin: 0; >@@ -152,7 +152,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > $(function () { > $("#topissuest").kohaTable({ > order: [[3, "desc"]], >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >index c196e8f9656..a7ee9e263d5 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-user.tt >@@ -1057,7 +1057,7 @@ > [% BLOCK jsinclude %] > [% INCLUDE 'calendar.inc' %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > var AR_CAPTION_COUNT = _("(%s total)"); > > >@@ -1430,7 +1430,7 @@ > [% END %] > [% IF OverDriveCirculation %] > [% Asset.js("js/overdrive.js") | $raw %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [%- IF Koha.Preference('OverDrivePasswordRequired') -%] > var OD_password_required = 1; > [%- ELSE -%] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >index f1946f43a1b..3fb432a44e7 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sci/sci-main.tt >@@ -53,22 +53,22 @@ > [% END %] > [% IF ( Koha.Preference('OPACUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('OPACUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('OPACUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] > <!-- prettier-ignore-start --> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > [% Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) | $raw %] > </style> > <!-- prettier-ignore-end --> > [% END %] > [% IF ( Koha.Preference('SelfCheckInUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('SelfCheckInUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('SelfCheckInUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > function _(s) { > return s; >@@ -231,7 +231,7 @@ > > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function mungeHistory() { > // prevent back button from allowing form resubmission > if (history && history.pushState) { >@@ -346,7 +346,7 @@ > }); > </script> > [% IF ( Koha.Preference('SelfCheckInUserJS') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% Koha.Preference('SelfCheckInUserJS') | $raw %] > </script> > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt >index f1aaf98a79a..60965f13484 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/help.tt >@@ -23,22 +23,22 @@ > [% Asset.css("css/sco.css") | $raw %] > [% IF ( Koha.Preference('OPACUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('OPACUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('OPACUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] > <!-- prettier-ignore-start --> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > [% Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) | $raw %] > </style> > <!-- prettier-ignore-end --> > [% END %] > [% IF ( SCOUserCSS ) %] > <!-- prettier-ignore-start --> >- <style>[% SCOUserCSS | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% SCOUserCSS | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > function _(s) { > return s; >@@ -100,7 +100,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% IF ( SCOUserJS ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% SCOUserJS | $raw %] > </script> > [% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt >index ff542c5dc13..51a382b91ef 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/printslip.tt >@@ -20,7 +20,7 @@ > [% IF stylesheet %] > <link rel="stylesheet" type="text/css" href="[% stylesheet | $raw %]" /> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > function _(s) { return s } // dummy function for gettext > const is_logged_in = [% IF logged_in_user %]true[% ELSE %]false[% END %] >diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >index 6a7f5d00a23..1e5f14a3f77 100644 >--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/sco/sco-main.tt >@@ -34,22 +34,22 @@ > [% END %] > [% IF ( Koha.Preference('OPACUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('OPACUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('OPACUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] > [% IF Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) %] > <!-- prettier-ignore-start --> >- <style> >+ <style nonce="[% Koha.CSPNonce | $raw %]"> > [% Branches.GetBranchSpecificCSS( Branches.GetLoggedInBranchcode() || default_branch) | $raw %] > </style> > <!-- prettier-ignore-end --> > [% END %] > [% IF ( Koha.Preference('SCOUserCSS') ) %] > <!-- prettier-ignore-start --> >- <style>[% Koha.Preference('SCOUserCSS') | $raw %]</style> >+ <style nonce="[% Koha.CSPNonce | $raw %]">[% Koha.Preference('SCOUserCSS') | $raw %]</style> > <!-- prettier-ignore-end --> > [% END %] >-<script> >+<script nonce="[% Koha.CSPNonce | $raw %]"> > var Koha = {}; > function _(s) { > return s; >@@ -410,7 +410,7 @@ > [% INCLUDE 'opac-bottom.inc' %] > [% BLOCK jsinclude %] > [% INCLUDE 'datatables.inc' %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > function mungeHistory() { > // prevent back button from allowing form resubmission > if (history && history.pushState) { >@@ -530,7 +530,7 @@ > </script> > [% Asset.js("js/holds.js") | $raw %] > [% IF ( Koha.Preference('SCOUserJS') ) %] >- <script> >+ <script nonce="[% Koha.CSPNonce | $raw %]"> > [% Koha.Preference('SCOUserJS') | $raw %] > </script> > [% END %] >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968