Add nonces to all script tags (#194)

labkey-adam · web-flow · commit 8c83c6dff499 · 2024-03-09T21:27:04.000-08:00
diff --git a/GenotypeAssays/resources/assay/GenotypeAssay/views/upload.html b/GenotypeAssays/resources/assay/GenotypeAssay/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function() {
         var webpart = <%=webpartContext%>;
diff --git a/GenotypeAssays/resources/assay/SSP_assay/views/upload.html b/GenotypeAssays/resources/assay/SSP_assay/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function() {
         var webpart = <%=webpartContext%>;
diff --git a/GenotypeAssays/resources/assay/SnpAssay/views/upload.html b/GenotypeAssays/resources/assay/SnpAssay/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function() {
         var webpart = <%=webpartContext%>;
diff --git a/GenotypeAssays/resources/views/bulkHaplotype.html b/GenotypeAssays/resources/views/bulkHaplotype.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function () {
         var analysisIds = LABKEY.ActionURL.getParameter('analysisIds');
diff --git a/GenotypeAssays/resources/views/sbtReview.html b/GenotypeAssays/resources/views/sbtReview.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function () {
         var analysisIds = LABKEY.ActionURL.getParameter('analysisIds');
diff --git a/LabPurchasing/resources/views/begin.html b/LabPurchasing/resources/views/begin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function (){
         var webpart = <%=webpartContext%>;
diff --git a/LabPurchasing/resources/views/manageReferenceItems.html b/LabPurchasing/resources/views/manageReferenceItems.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function (){
         var webpart = <%=webpartContext%>;
diff --git a/LabPurchasing/resources/views/populateData.html b/LabPurchasing/resources/views/populateData.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     // NOTE: Unofficial API to import a file.  Eventually, move this to LABKEY.Query or support importing files directly in LABKEY.Query.importRows().
     function importFile(config) {
diff --git a/PMR/resources/views/pmrAdmin.html b/PMR/resources/views/pmrAdmin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function (){
     var webpart = <%=webpartContext%>;
diff --git a/PMR/resources/views/pmrAnimalHistory.html b/PMR/resources/views/pmrAnimalHistory.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function (){
         var webpart = <%=webpartContext%>;
diff --git a/PMR/resources/views/populateData.html b/PMR/resources/views/populateData.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 // NOTE: Unofficial API to import a file.  Eventually, move this to LABKEY.Query or support importing files directly in LABKEY.Query.importRows().
 function importFile(config) {
diff --git a/covidseq/resources/views/sampleImport.html b/covidseq/resources/views/sampleImport.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/elispot_assay/resources/assay/ELISPOT_Assay/views/upload.html b/elispot_assay/resources/assay/ELISPOT_Assay/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function() {
     var webpart = <%=webpartContext%>;
diff --git a/flowassays/resources/assay/ICS/views/upload.html b/flowassays/resources/assay/ICS/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function() {
     var webpart = <%=webpartContext%>;
diff --git a/flowassays/resources/assay/Immunophenotype_Assay/views/upload.html b/flowassays/resources/assay/Immunophenotype_Assay/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function() {
     var webpart = <%=webpartContext%>;
diff --git a/flowassays/resources/views/initModule.html b/flowassays/resources/views/initModule.html
@@ -1,5 +1,5 @@
 <head>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 /*!
  * Ext JS Library 3.2.1
diff --git a/mGAP/resources/views/admin.html b/mGAP/resources/views/admin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var panel = Ext4.create('Ext.panel.Panel', {
             border: false,
diff --git a/mGAP/resources/views/annotation.html b/mGAP/resources/views/annotation.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function($){
         $( document ).ready(function() {
             var webpart = <%=webpartContext%>;
diff --git a/mGAP/resources/views/contact.html b/mGAP/resources/views/contact.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var panel = Ext4.create('Ext.form.Panel', {
             border: false,
diff --git a/mGAP/resources/views/data.html b/mGAP/resources/views/data.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mGAP/resources/views/demographics.html b/mGAP/resources/views/demographics.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mGAP/resources/views/externalData.html b/mGAP/resources/views/externalData.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mGAP/resources/views/geneSearch.html b/mGAP/resources/views/geneSearch.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     +function() {
         const ctx = LABKEY.getModuleContext('mgap') || {};
         const sessionId = ctx.mgapJBrowse
diff --git a/mGAP/resources/views/login.html b/mGAP/resources/views/login.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function($, LABKEY) {
         $(function(){
             if (!LABKEY.Security.currentUser.isAdmin) {
diff --git a/mGAP/resources/views/overview.html b/mGAP/resources/views/overview.html
@@ -3,7 +3,7 @@
         display: flex;
     }
 </style>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function($){
         $( document ).ready(function() {
             mGAP.Utils.renderReleaseGraph('mgap-graph-outer', 300);
@@ -15,7 +15,7 @@
     })(jQuery);
 </script>
 
-<script>
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     $( function() {
         $( "i.mgap-video-icon" ).on("click", function(e){
             mGAP.Utils.showVideoDialog(e);
diff --git a/mGAP/resources/views/phenotypeList.html b/mGAP/resources/views/phenotypeList.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function (){
         var rowId = LABKEY.ActionURL.getParameter('release');
         if (!rowId){
diff --git a/mGAP/resources/views/phenotypes.html b/mGAP/resources/views/phenotypes.html
@@ -4,7 +4,7 @@
         display: flex;
     }
 </style>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function ($){
         $(function(){
             var rawData = [
diff --git a/mGAP/resources/views/quickLinks.html b/mGAP/resources/views/quickLinks.html
@@ -5,7 +5,7 @@
     }​
 </style>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function (){
         var releaseId = mGAP.Utils.getMGapReleaseId();
         var jbrowseId = mGAP.Utils.getMGapJBrowseSession();
diff --git a/mGAP/resources/views/requestLogin.html b/mGAP/resources/views/requestLogin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var panel = Ext4.create('Ext.form.Panel', {
             border: false,
diff --git a/mGAP/resources/views/tutorials.html b/mGAP/resources/views/tutorials.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function($){
         $( document ).ready(function() {
             const videos = [{
diff --git a/mGAP/resources/views/variantList.html b/mGAP/resources/views/variantList.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function (){
         var rowId = LABKEY.ActionURL.getParameter('release');
         if (!rowId){
diff --git a/mGAP/resources/views/variants.html b/mGAP/resources/views/variants.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mGAP/resources/views/welcome.html b/mGAP/resources/views/welcome.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     (function($, LABKEY) {
         $(function(){
             var ctx = LABKEY.getModuleContext('mgap') || {};
@@ -69,14 +69,14 @@ <h3 class="title">The Macaque Genotype And Phenotype Resource</h3>
     </div>
     <!-- /.container -->
 
-    <script>
-        $(document).ready(function() {
+    <script type="text/javascript" nonce="<%=scriptNonce%>">
+        $(document).ready(function () {
             $('#slideshow').cycle({
                 fx: 'fade',
                 pager: '#smallnav',
-                pause:   1,
+                pause: 1,
                 speed: 1800,
-                timeout:  3500
+                timeout: 3500
             });
         });
     </script>
diff --git a/mcc/resources/views/begin.html b/mcc/resources/views/begin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/contact.html b/mcc/resources/views/contact.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var panel = Ext4.create('Ext.form.Panel', {
             border: false,
diff --git a/mcc/resources/views/dashboardWebpart.html b/mcc/resources/views/dashboardWebpart.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     +function() {
         LABKEY.App.loadApp('dashboardWebpart', <%=webpartContext%>.wrapperDivId)
     }();
diff --git a/mcc/resources/views/geneticsPlotWebpart.html b/mcc/resources/views/geneticsPlotWebpart.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     +function() {
         LABKEY.App.loadApp('geneticsPlotWebpart', <%=webpartContext%>.wrapperDivId)
     }();
diff --git a/mcc/resources/views/login.html b/mcc/resources/views/login.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 </script>
 <form class="auth-form" name="login" action="javascript:void(0)" method="post">
diff --git a/mcc/resources/views/manualMccId.html b/mcc/resources/views/manualMccId.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/mccAdmin.html b/mcc/resources/views/mccAdmin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function (){
     var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/mccColony.html b/mcc/resources/views/mccColony.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function (){
     var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/mccDataImport.html b/mcc/resources/views/mccDataImport.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/mccFolderInit.html b/mcc/resources/views/mccFolderInit.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function (){
 
diff --git a/mcc/resources/views/mccMenu.html b/mcc/resources/views/mccMenu.html
@@ -1,6 +1,6 @@
 <div class="mcc-nav-menu-panel"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         Ext4.QuickTips.init();
diff --git a/mcc/resources/views/mccRequestAdmin.html b/mcc/resources/views/mccRequestAdmin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/mccRequests.html b/mcc/resources/views/mccRequests.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/nihReview.html b/mcc/resources/views/nihReview.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/populateData.html b/mcc/resources/views/populateData.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 // NOTE: Unofficial API to import a file.  Eventually, move this to LABKEY.Query or support importing files directly in LABKEY.Query.importRows().
 function importFile(config) {
diff --git a/mcc/resources/views/rabRequestReview.html b/mcc/resources/views/rabRequestReview.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/mcc/resources/views/requestLogin.html b/mcc/resources/views/requestLogin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var panel = Ext4.create('Ext.form.Panel', {
             border: false,
diff --git a/primeseq/resources/views/geneticsMenu.html b/primeseq/resources/views/geneticsMenu.html
@@ -1,6 +1,6 @@
 <div class="primeseq-nav-menu-panel"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         Ext4.QuickTips.init();
diff --git a/primeseq/resources/views/methylationComparison.html b/primeseq/resources/views/methylationComparison.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var outputFileIds = LABKEY.ActionURL.getParameter('outputFileIds') || '';
diff --git a/primeseq/resources/views/methylationRateComparison.html b/primeseq/resources/views/methylationRateComparison.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var outputFileIds = LABKEY.ActionURL.getParameter('outputFileIds') || '';
diff --git a/tcrdb/resources/assay/TCRdb/views/upload.html b/tcrdb/resources/assay/TCRdb/views/upload.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function() {
     var webpart = <%=webpartContext%>;

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-<script type="text/javascript">`
	`1`	`+<script type="text/javascript" nonce="<%=scriptNonce%>">`
`2`	`2`
`3`	`3`	`Ext4.onReady(function() {`
`4`	`4`	`var webpart = <%=webpartContext%>;`