Add nonces to script tags (#187)

labkey-adam · web-flow · commit 7da2645a4f9d · 2024-02-19T17:45:01.000-08:00
diff --git a/LDK/resources/views/apiBulkEdit.html b/LDK/resources/views/apiBulkEdit.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         Ext4.define('LDK.panel.BulkUpdatePanel', {
             extend: 'Ext.form.Panel',
diff --git a/LDK/resources/views/calendar.html b/LDK/resources/views/calendar.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         // This is an example calendar store that enables event color-coding
         this.calendarStore = Ext4.create('Ext.calendar.data.MemoryCalendarStore', {
diff --git a/LDK/resources/views/folderSizeSummary.html b/LDK/resources/views/folderSizeSummary.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
         Ext4.define('LDK.panel.FolderSizeSummaryPanel', {
diff --git a/LDK/resources/views/manageRecord.html b/LDK/resources/views/manageRecord.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/LDK/resources/views/notificationAdmin.html b/LDK/resources/views/notificationAdmin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
         Ext4.create('LDK.panel.NotificationAdminPanel', {}).render(webpart.wrapperDivId);
diff --git a/LDK/resources/views/notificationSiteAdmin.html b/LDK/resources/views/notificationSiteAdmin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         LABKEY.Ajax.request({
             url : LABKEY.ActionURL.buildURL('ldk', 'getSiteNotificationDetails', '/'),
diff --git a/LDK/resources/views/runCustomSql.html b/LDK/resources/views/runCustomSql.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/LDK/resources/views/setRedirectUrl.html b/LDK/resources/views/setRedirectUrl.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/LDK/resources/views/unitTest.html b/LDK/resources/views/unitTest.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     LABKEY.requiresCss("laboratory/Ext.ux.UnitTest.css");
     LABKEY.requiresScript("/laboratory/Ext.ux.UnitTest.js");
 
diff --git a/LDK/test/src/org/labkey/test/tests/external/labModules/LabModulesTest.java b/LDK/test/src/org/labkey/test/tests/external/labModules/LabModulesTest.java
@@ -242,7 +242,7 @@ public void testSteps() throws Exception
     protected void setUpTest() throws Exception
     {
         goToHome();
-        beginAt("/project/shared/begin.view");
+        beginAt("/shared/project-begin.view");
         _containerHelper.enableModule("Laboratory");
         goToHome();
 
diff --git a/laboratory/resources/views/assayDefaults.html b/laboratory/resources/views/assayDefaults.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/begin.html b/laboratory/resources/views/begin.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/customizeDataBrowser.html b/laboratory/resources/views/customizeDataBrowser.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/folderSummary.html b/laboratory/resources/views/folderSummary.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/freezerDetails.html b/laboratory/resources/views/freezerDetails.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/freezerSummary.html b/laboratory/resources/views/freezerSummary.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/itemDefaultViews.html b/laboratory/resources/views/itemDefaultViews.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/itemVisibility.html b/laboratory/resources/views/itemVisibility.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/labSettings.html b/laboratory/resources/views/labSettings.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/labTools.html b/laboratory/resources/views/labTools.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/labWorkbooks.html b/laboratory/resources/views/labWorkbooks.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/manageDataSources.html b/laboratory/resources/views/manageDataSources.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         if (LABKEY.Security.currentContainer.type == 'workbook'){
diff --git a/laboratory/resources/views/manageSubjects.html b/laboratory/resources/views/manageSubjects.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
 
diff --git a/laboratory/resources/views/populateInitialValues.html b/laboratory/resources/views/populateInitialValues.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
 
diff --git a/laboratory/resources/views/prepareExptRun.html b/laboratory/resources/views/prepareExptRun.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
         var assayId = LABKEY.ActionURL.getParameter('assayId');
diff --git a/laboratory/resources/views/reportList.html b/laboratory/resources/views/reportList.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         var webpart = <%=webpartContext%>;
diff --git a/laboratory/resources/views/reports.html b/laboratory/resources/views/reports.html
@@ -1,5 +1,5 @@
 <head>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     Ext4.ns('Laboratory.reports');
 
     Laboratory.reports.viralLoadGraph = function(){alert('hello')}
diff --git a/laboratory/resources/views/samplesList.html b/laboratory/resources/views/samplesList.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 Ext4.onReady(function(){
     Laboratory.Utils.getDataItems({
diff --git a/laboratory/resources/views/siteLabSettings.html b/laboratory/resources/views/siteLabSettings.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     if (!LABKEY.Security.currentUser.isSystemAdmin){
         window.location = LABKEY.ActionURL.buildURL('project', 'start', 'home');
     }
diff --git a/laboratory/resources/views/synchronizeAssayFields.html b/laboratory/resources/views/synchronizeAssayFields.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     Ext4.onReady(function(){
         if (!LABKEY.Security.currentUser.isSystemAdmin){
diff --git a/laboratory/src/org/labkey/laboratory/LaboratoryDataProvider.java b/laboratory/src/org/labkey/laboratory/LaboratoryDataProvider.java
@@ -133,7 +133,7 @@ public List<NavItem> getReportItems(Container c, User u)
 
             for (Study study : StudyService.get().getAllStudies(c, u))
             {
-                items.add(new DetailsUrlWithoutLabelNavItem(this, study.getLabel(), DetailsURL.fromString("/study/begin.view", study.getContainer()), LaboratoryService.NavItemCategory.reports, "Studies"));
+                items.add(new DetailsUrlWithoutLabelNavItem(this, study.getLabel(), DetailsURL.fromString("/study-begin.view", study.getContainer()), LaboratoryService.NavItemCategory.reports, "Studies"));
             }
 
 //            FileContentService service = FileContentService.get();
diff --git a/laboratory/src/org/labkey/laboratory/view/dataBrowser.jsp b/laboratory/src/org/labkey/laboratory/view/dataBrowser.jsp
@@ -34,7 +34,7 @@
 
 <div id="<%=h(wpId)%>"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     Ext4.onReady(function(){
         var webpartId = <%=q(wpId)%>;
 
diff --git a/laboratory/src/org/labkey/laboratory/view/workbookHeader.jsp b/laboratory/src/org/labkey/laboratory/view/workbookHeader.jsp
@@ -51,7 +51,7 @@
 
 <div id="<%=h(wpId)%>"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     Ext4.onReady(function(){
         var webpartId = <%=q(wpId)%>;
         var workbookId = <%=h(workbookId)%>;

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-<script type="text/javascript">`
	`1`	`+<script type="text/javascript" nonce="<%=scriptNonce%>">`
`2`	`2`	`Ext4.onReady(function(){`
`3`	`3`	`Ext4.define('LDK.panel.BulkUpdatePanel', {`
`4`	`4`	`extend: 'Ext.form.Panel',`
Original file line number	Diff line number	Diff line change
`@@ -242,7 +242,7 @@ public void testSteps() throws Exception`
`242`	`242`	`protected void setUpTest() throws Exception`
`243`	`243`	`{`
`244`	`244`	`goToHome();`
`245`		`- beginAt("/project/shared/begin.view");`
	`245`	`+ beginAt("/shared/project-begin.view");`
`246`	`246`	`_containerHelper.enableModule("Laboratory");`
`247`	`247`	`goToHome();`
`248`	`248`