sub DEFAULT_CSP {
my %policy = (
default_src => [ 'self' ],
- script_src => [ 'self', 'unsafe-inline', 'unsafe-eval', 'https://www.google-analytics.com' ],
- child_src => [ 'self', ],
+ script_src => [ 'self', 'nonce', 'unsafe-inline', 'https://www.google-analytics.com' ],
+ frame_src => [ 'none', ],
+ worker_src => [ 'none', ],
img_src => [ 'self', 'https://secure.gravatar.com', 'https://www.google-analytics.com' ],
style_src => [ 'self', 'unsafe-inline' ],
object_src => [ 'none' ],
'https://www.google.com/search'
],
frame_ancestors => [ 'none' ],
- disable => 1,
+ report_only => 1,
);
if (Bugzilla->params->{github_client_id} && !Bugzilla->user->id) {
push @{$policy{form_action}}, 'https://github.com/login/oauth/authorize', 'https://github.com/login';
# This is from extensions/OrangeFactor/web/js/orange_factor.js
'https://brasstacks.mozilla.com/orangefactor/api/count',
],
- child_src => [
- 'self',
- # This is for the socorro lens addon and is to be removed by Bug 1332016
- 'https://ashughes1.github.io/bugzilla-socorro-lens/chart.htm'
- ],
+ frame_src => [ 'none', ],
+ worker_src => [ 'none', ],
);
if (use_attachbase() && $bug_id) {
my $attach_base = Bugzilla->localconfig->{'attachment_base'};
require Bugzilla::CGI::ContentSecurityPolicy;
if (%add_params || !$self->{Bugzilla_csp}) {
my %params = DEFAULT_CSP;
- delete $params{disable} if %add_params && !$add_params{disable};
+ delete $params{report_only} if %add_params && !$add_params{report_only};
foreach my $key (keys %add_params) {
if (defined $add_params{$key}) {
$params{$key} = $add_params{$key};
my @ALL_BOOL = qw( sandbox upgrade_insecure_requests );
my @ALL_SRC = qw(
- default_src child_src connect_src
+ default_src worker_src connect_src
font_src img_src media_src
object_src script_src style_src
- frame_ancestors form_action
+ frame_src frame_ancestors form_action
);
has \@ALL_SRC => ( is => 'ro', isa => $SOURCE_LIST, predicate => 1 );
local our $template = Bugzilla->template;
local our $vars = {};
my $dbh = Bugzilla->dbh;
+$cgi->content_security_policy(report_only => 0);
my $user = Bugzilla->login(LOGIN_REQUIRED);
style_urls = [ 'extensions/BMO/web/styles/create_account.css' ]
%]
-<script>
+<script [% script_nonce FILTER none %]>
function onSubmit() {
var email = document.getElementById('login').value;
var agreed = document.getElementById('etiquette').checked;
<span>Calendar</span>
</button>
<div id="con_calendar_prototype_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('prototype_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_production_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('production_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_launch_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('launch_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_cf_due_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('cf_due_date')
</script>
</div>
style = ".mandatory{color:red;font-size:80%;}"
%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function trySubmit() {
var alert_text = "";
<span>Calendar</span>
</button>
<div id="con_calendar_start_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('start_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_announce_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('announce_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_cf_due_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('cf_due_date')
</script>
</div>
We do this to help protect the personal identifying information in this [% terms.bugs %].
</p>
-<script>
+<script [% script_nonce FILTER none %]>
initFields();
onPurposeChange();
onAddGearChange();
<span>Calendar</span>
</button>
<div id="con_calendar_timing_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('timing_date')
</script>
</div>
<span id="security_group_warning" style="color:red; display:none;">
This security group needs to be set to SHOWN/SHOWN
</span>
- <script>
+ <script [% script_nonce FILTER none %]>
var toggleGroupWarning = function() {
var correct_shown = $('#security_group_id option:selected').data('group-correct-visibility');
if ($('#security_group_id').val() === '' || correct_shown) {
[% attachment_data FILTER html %]
</pre>
[% IF user.id %]
- <script>
+ <script [% script_nonce FILTER none %]>
<!--
var patchviewerinstalled = 0;
document.write('<button type="button" id="editButton" onclick="editAsComment(patchviewerinstalled);">Edit Attachment As Comment<\/button>');
&& (comment.author.login_name == 'tbplbot@gmail.com' || comment.author.login_name == 'orangefactor@bots.tld')
%]
[% has_tbpl_comment = 1 %]
- <script>
+ <script [% script_nonce FILTER none %]>
var id = [% count FILTER none %];
tbpl_comment_ids.push(id);
collapse_comment(
[% collapse_caption = 'Collapse TinderboxPushlog Comments' %]
[% show_caption = 'Show TinderboxPushlog Comments' %]
[% hide_caption = 'Hide TinderboxPushlog Comments' %]
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Event.onDOMReady(function () {
var ul = document.getElementsByClassName('bz_collapse_expand_comments');
if (ul.length == 0)
[%# Needed for collapsing TinderboxPushlog comments %]
[% has_tbpl_comment = 0 %]
-<script>
+<script [% script_nonce FILTER none %]>
var tbpl_comment_ids = new Array();
</script>
#%]
[%# Display product and component descriptions after their respective fields %]
-<script>
+<script [% script_nonce FILTER none %]>
var Event = YAHOO.util.Event;
var Dom = YAHOO.util.Dom;
Event.onDOMReady(function() {
id = field.name name = field.name minrows = 4 maxrows = 8
cols = 60 defaultcontent = value %]
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
hideEditableField('[% field.name FILTER js %]_edit_container',
'[% field.name FILTER js %]_input',
'[% field.name FILTER js %]_edit_action',
<span>Calendar</span>
</button>
<div id="con_calendar_reported_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('reported_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_fixed_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('fixed_date')
</script>
</div>
<span>Calendar</span>
</button>
<div id="con_calendar_awarded_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('awarded_date')
</script>
</div>
<h1>JavaScript is required to use this report.</h1>
</noscript>
-<script>
+<script [% script_nonce FILTER none %]>
var flags_data = $.parseJSON("[% flags_json FILTER js %]");
var products_data = $.parseJSON("[% products_json FILTER js %]");
var fields_data = $.parseJSON("[% fields_json FILTER js %]");
</table>
</form>
-<script>
+<script [% script_nonce FILTER none %]>
createCalendar('last_is');
</script>
[% END %]
</form>
-<script>
+<script [% script_nonce FILTER none %]>
createCalendar('from');
createCalendar('to');
</script>
[% SET selectable_products = user.get_selectable_products %]
[% SET dont_show_button = 1 %]
-<script>
+<script [% script_nonce FILTER none %]>
var useclassification = false;
var first_load = true;
var last_sel = [];
}
</style>
-<script>
+<script [% script_nonce FILTER none %]>
var Dom = YAHOO.util.Dom;
var useclassification = false;
var first_load = true;
<script src="[% 'js/productform.js' FILTER version FILTER html %]">
</script>
-<script>
+<script [% script_nonce FILTER none %]>
function onSelectProduct() {
var component = Dom.get('component');
selectProduct(Dom.get('product'), component);
</td>
</tr>
-<script>
+<script [% script_nonce FILTER none %]>
function sanitise_name(name) {
return name.toLowerCase()
.replace(/[^a-z0-9_]/g, '-')
<input type="submit" value="Commit Changes" id="commit_btn" class="bz_default_hidden">
</form>
-<script>
+<script [% script_nonce FILTER none %]>
var table_data_str = "[% table_data FILTER js %]";
var table_data = $.parseJSON(table_data_str);
var editTable = new EditTable('edit_table', table_data);
#%]
[% IF flag_default_requestees.keys.size %]
- <script>
+ <script [% script_nonce FILTER none %]>
var currently_requested = new Array();
var default_requestees = new Array();
[% FOREACH id = flag_currently_requested.keys %]
#%]
[% IF ftc_flags.keys.size %]
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Event.onDOMReady(function() {
var selects = YAHOO.util.Dom.getElementsByClassName('flag_select');
for (var i = 0; i < selects.length; i++) {
<div id="loading" class="hidden">
Please wait...
</div>
-<script>
+<script [% script_nonce FILTER none %]>
YAHOO.util.Dom.removeClass('loading', 'hidden');
</script>
<a id="advanced_link" href="enter_bug.cgi?format=__default__">Switch to the advanced [% terms.bug %] entry form</a>
</div>
-<script>
+<script [% script_nonce FILTER none %]>
YAHOO.util.Dom.addClass('loading', 'hidden');
guided.init({ webdev: [% webdev ? "true" : "false" %] });
guided.currentUser = '[% user.login FILTER js %]';
[%# this div exists to allow bugzilla-tweaks to detect when we're active %]
<div id="inline-history-ext"></div>
-<script>
+<script [% script_nonce FILTER none %]>
var ih_activity = new Array();
var ih_activity_flags = new Array();
var ih_activity_sort_order = '[% user.settings.comment_sort_order.value FILTER js %]';
</div>
</script>
-<script>
+<script [% script_nonce FILTER none %]>
[% IF Param('splinter_base') %]
MyDashboard.splinter_base = '[% Bugzilla.splinter_review_base FILTER js %]';
[% END %]
[% PROCESS bug/needinfo.html.tmpl
bug => attachment.bug
%]
-<script>
+<script [% script_nonce FILTER none %]>
document.getElementById('editButton').addEventListener('click', function() {
document.getElementById('attachment_view_window')
.appendChild(document.getElementById('needinfo_container'));
style_urls = [ 'extensions/Push/web/admin.css' ]
%]
-<script>
+<script [% script_nonce FILTER none %]>
var push_defaults = new Array();
[% FOREACH option = push.config.options %]
[% IF option.name != 'enabled' && option.default != '' %]
</tr>
[% END %]
[% IF name != 'global' %]
- <script>
+ <script [% script_nonce FILTER none %]>
var is_enabled = document.getElementById('[% name FILTER js %]_enabled').value == 'Enabled';
toggle_options(is_enabled, '[% name FILTER js %]');
</script>
any persons designated in the CC line, and authorized members of the Mozilla
Rep team.</p>
-<script>
+<script [% script_nonce FILTER none %]>
function trySubmit() {
var firstname = document.getElementById('firstname').value;
var lastname = document.getElementById('lastname').value;
<span>Calendar</span>
</button>
<div id="con_calendar_cf_due_date"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('cf_due_date')
</script>
</td>
[% USE Bugzilla %]
[% mandatory = '<span class="mandatory" title="Required">*</span>' %]
-<script>
+<script [% script_nonce FILTER none %]>
var Dom = YAHOO.util.Dom;
function mandatory(elements) {
<p>These requests will only be visible to the person who submitted the request,
any persons designated in the CC line, and authorized members of the Mozilla Rep team.</p>
-<script>
+<script [% script_nonce FILTER none %]>
function trySubmit() {
var eventname = document.getElementById('eventname').value;
var shortdesc = 'Swag Request - ' + eventname;
'js/field.js' ]
%]
-<script></script>
+<script [% script_nonce FILTER none %]></script>
<h1>Mozilla Reps - Payment Form</h1>
[% bug = attachment.bug %]
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
$(function() {
[% IF bug.product_obj.reviewer_required %]
REVIEW.init_mandatory();
#%]
[% IF attachment.bug.product_obj.reviewer_required %]
-<script>
+<script [% script_nonce FILTER none %]>
$(function() {
REVIEW.init_mandatory();
});
# defined by the Mozilla Public License, v. 2.0.
#%]
-<script>
+<script [% script_nonce FILTER none %]>
$(function() {
[% IF product.reviewer_required %]
REVIEW.init_mandatory();
%]
<br>
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
hideEditableField('bz_bug_mentors_edit_container',
'bz_bug_mentors_input',
'bz_bug_mentors_edit_action',
<a href="#" id="[% fid FILTER none %]_suggestions_link">suggested reviewers ▾</a>
</span>
-<script>
+<script [% script_nonce FILTER none %]>
REVIEW.init_review_flag('[% fid FILTER none %]', '[% flag_name FILTER none %]');
</script>
'js/field.js' ]
%]
-<script>
+<script [% script_nonce FILTER none %]>
$(function () {
YUI({
base: 'js/yui3/',
</td>
</tr>
-<script>
+<script [% script_nonce FILTER none %]>
$(function() {
'use strict';
var securemail_groups = [];
[% can_edit = 0 %]
-<script>
+<script [% script_nonce FILTER none %]>
Splinter.configBase = '[% Bugzilla.splinter_review_base FILTER js %]';
Splinter.configBugUrl = '[% urlbase FILTER js %]';
Splinter.configHaveExtension = true;
any_flags_requesteeble = any_flags_requesteeble
%]
[% END %]
- <script>
+ <script [% script_nonce FILTER none %]>
[% FOREACH flag_type = flag_types %]
[% NEXT UNLESS flag_type.is_active %]
Event.addListener('flag_type-[% flag_type.id FILTER js %]', 'change',
[% value.name FILTER html %]</option>
[% END %]
</select>
- <script>
+ <script [% script_nonce FILTER none %]>
initHidingOptionsForIE('[% flag.name FILTER js %]');
</script>
[% IF !new_bug && user.id %]
</tr>
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
var tracking_flags_str = "[% tracking_flags_json FILTER js %]";
TrackingFlags = $.parseJSON(tracking_flags_str);
</script>
END;
%]
-<script>
+<script [% script_nonce FILTER none %]>
$(function() {
var tracking_flag_components_str = "[% tracking_flag_components FILTER js %]";
var tracking_flag_components = $.parseJSON(tracking_flag_components_str);
[% END %]
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
var tracking_flags_str = "[% tracking_flags_json FILTER js %]";
var TrackingFlags = $.parseJSON(tracking_flags_str);
hide_tracking_flags();
</option>
[% END %]
</select>
-<script>
+<script [% script_nonce FILTER none %]>
<!--
initHidingOptionsForIE('[% field.name FILTER js %]');
[%+ INCLUDE "bug/field-events.js.tmpl"
style_urls = [ 'extensions/TrackingFlags/web/styles/admin.css' ]
%]
-<script>
+<script [% script_nonce FILTER none %]>
var groups_str = "[% groups || '[]' FILTER js %]";
var groups = $.parseJSON(groups_str);
var flag_values_str = "[% values || '[]' FILTER js %]";
[% can_edit_story = bug.check_can_change_field('cf_user_story', 0, 1) %]
<div class="user_story">
- <script>
+ <script [% script_nonce FILTER none %]>
function userStoryComment() {
var commenttext = "(Commenting on User Story)\n";
var text_elem = document.getElementById('user_story');
cols = constants.COMMENT_COLS
defaultcontent = bug.cf_user_story %]
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Event.addListener('user_story_edit_action', 'click', function() {
YAHOO.util.Dom.addClass('user_story_edit', 'bz_default_hidden');
YAHOO.util.Dom.addClass('user_story_readonly', 'bz_default_hidden');
defaultcontent = user_story_default
%]
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
var user_story_exclude_components = [];
[% FOREACH c = default.user_story_visible.1 %]
user_story_exclude_components.push('[% c FILTER js %]');
value="[% product.votestoconfirm FILTER html %]">
<br>(Setting this to 0 disables auto-confirming [% terms.bugs %]
by vote.)
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Event.addListener('allows_unconfirmed', 'change',
function() { bz_toggleClass('votes_to_confirm_container',
'bz_default_hidden'); });
my $template = Bugzilla->template;
my $vars = {};
+$cgi->content_security_policy(report_only => 0);
+
# Go straight back to query.cgi if we are adding a boolean chart.
if (grep(/^cmd-/, $cgi->param())) {
my $params = $cgi->canonicalise_query("format", "ctype");
</div>
<div style="width:300px; height:75px; color:red; text-align:center; visibility:hidden;" id='warn'></div>
<script src='js/main.js'></script>
- <script>
+ <script [% script_nonce FILTER none %]>
document.addEventListener('DOMContentLoaded', function () {
document.querySelector('select[name="channel"]').onchange = channelEventHandler;
document.querySelector('select[name="match"]').onchange = matchEventHandler;
filter some or all notifications.
</p>
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function SetCheckboxes(setting) {
for (var count = 0; count < document.userprefsform.elements.length; count++) {
#%]
[% IF user.can_bless %]
- <script><!--
+ <script [% script_nonce FILTER none %]><!--
function update_checkbox(group) {
var bless_groups = [[% bless_group_ids.join(",") FILTER js %]];
var checkbox = document.getElementById(group.name.replace(/share_(\d+)/, "force_$1"));
</table>
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
$().ready(function() {
var id = document.location.hash.substring(1) + '_row';
$('#' + id).addClass('highlighted');
%]
[%# set initial editability of fields such as Reverse Relationship Description %]
-<script>
+<script [% script_nonce FILTER none %]>
YAHOO.util.Event.onDOMReady(function() {onChangeType(document.getElementById('type'))});
</script>
</tr>
</table>
- <script>
+ <script [% script_nonce FILTER none %]>
bz_toggleClass("input_[% param.name FILTER html %]", "bz_default_hidden");
bz_toggleClass("table_[% param.name FILTER html %]", "bz_default_hidden");
</script>
style_urls = ['skins/standard/admin.css']
%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function toggle_cell(cell) {
if (cell.checked)
style_urls = ['skins/standard/admin.css']
%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function toggle_cell(cell) {
if (cell.checked)
doc_section = "attachments.html"
%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
TUI_hide_default('attachment_text_field');
-->
# Marc Schumann <wurblzap@gmail.com>
#%]
+<script [% script_nonce FILTER none %]>
+ document.addEventListener("DOMContentLoaded", function (event) {
+ document.querySelector("#attachment_data_controller").addEventListener(
+ "click", function (event) {
+ TUI_toggle_class('attachment_text_field');
+ TUI_toggle_class('attachment_data');
+ });
+ });
+</script>
+
<tr class="attachment_data">
<th><label for="data">File</label>:</th>
<td>
<em>Enter the path to the file on your computer</em> (or
- <a id="attachment_data_controller" href="javascript:TUI_toggle_class('attachment_text_field');
- javascript:TUI_toggle_class('attachment_data')"
- >paste text as attachment</a>).<br>
+ <a id="attachment_data_controller">
+ paste text as attachment</a>).<br>
<input type="file" id="data" name="data" size="50">
</td>
</tr>
<input type="checkbox" id="ispatch" name="ispatch" value="1">
<label for="ispatch">patch</label><br><br>
[%# Reset this whenever the page loads so that the JS state is up to date %]
- <script [% csp_nonce FILTER none %]>
+ <script [% script_nonce FILTER none %]>
$(function() {
$("#file").on("change", function() {
DataFieldHandler();
[% END %]
[% END %]
</td></tr></thead><tbody class="[% collapsed ? 'file_collapse' : 'file' %]">
-<script>
+<script [% script_nonce FILTER none %]>
incremental_restore()
</script>
<a href="attachment.cgi?id=[% attachment.id %]">View the attachment on a separate page</a>.</b>
</iframe>
[% END %]
- <script>
+ <script [% script_nonce FILTER none %]>
<!--
var patchviewerinstalled = 0;
var attachment_id = [% attachment.id %];
[% END %]
</div>
[% IF can_edit %]
- <script>
+ <script [% script_nonce FILTER none %]>
<!--
YAHOO.util.Dom.removeClass( document.body, "no_javascript" );
toggle_attachment_details_visibility( );
# Frédéric Buclin <LpSolit@gmail.com>
#%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function toggle_display(link) {
var table = document.getElementById("attachment_table");
<script src="[% 'js/comments.js' FILTER version %]">
</script>
-<script>
+<script [% script_nonce FILTER none %]>
<!--
/* Adds the reply text to the 'comment' textarea */
function replyToComment(id, real_id, name) {
[% IF comment.collapsed %]
</span>
[% END %]
- <script>
+ <script [% script_nonce FILTER none %]>
addCollapseLink([% comment.count %], [% comment.collapsed FILTER js %], 'Toggle comment display');
</script>
</span>
[% ELSIF comment.collapsed %]
<span class="bz_comment_actions">
- <script>
+ <script [% script_nonce FILTER none %]>
addCollapseLink([% comment.count %], [% comment.collapsed FILTER js %], 'Toggle comment display');
</script>
</span>
[% " bz_default_hidden" UNLESS comment.tags.size %]">
<span id="ct_[% comment.count %]">
[% IF comment.tags.size %]
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.bugzilla.commentTagging.showTags([% comment.id FILTER none %],
[% comment.count FILTER none %], [
[% FOREACH tag = comment.tags %]
[% tablecolour = "#FFFFCC" %]
[%# This script displays the descriptions for selected components. %]
-<script>
+<script [% script_nonce FILTER none %]>
var descriptions = [
[% FOREACH c = product.components %]
'[% c.description FILTER js %]',
<td valign="top" width="100%">
<div id="description" style="color: green; margin-left: 10px;
height: 5em; overflow: auto;">
- <script>
+ <script [% script_nonce FILTER none %]>
if ((document.getElementById) && (document.body.innerHTML)) {
document.write("\
Select a component to see its description here.");
onload = "init();"
%]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
function init() {
<input type="button" id="expert_fields_controller"
value="Hide Advanced Fields" onClick="toggleAdvancedFields()">
[%# Show the link if the browser supports JS %]
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Dom.removeClass('expert_fields_controller',
'bz_default_hidden');
</script>
[%- END %]
</select>
- <script>
+ <script [% script_nonce FILTER none %]>
<!--
[%+ INCLUDE "bug/field-events.js.tmpl"
field = bug_fields.component, product = product %]
<th>Possible<br>Duplicates:</th>
<td colspan="3">
<div id="possible_duplicates"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
var dt_columns = [
{ key: "id", label: "[% field_descs.bug_id FILTER js %]",
formatter: YAHOO.bugzilla.dupTable.formatBugLink },
</div>
[% END %]
[% IF user.id %]
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.bugzilla.commentTagging.init([% user.can_tag_comments ? 'true' : 'false' %]);
YAHOO.bugzilla.commentTagging.min_len = [% constants.MIN_COMMENT_TAG_LENGTH FILTER js %];
YAHOO.bugzilla.commentTagging.max_len = [% constants.MAX_COMMENT_TAG_LENGTH FILTER js %];
[% END %]
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
<!--
[% IF user.is_timetracker %]
var fRemainingTime = [% bug.remaining_time %]; // holds the original value
</table>
</div>
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
hideAliasAndSummary('[% bug.short_desc FILTER js %]', '[% bug.alias FILTER js %]');
</script>
[% END %]
[%# BMO - hook for adding mentors %]
[% Hook.process("after_people", "bug/edit.html.tmpl") %]
- <script>
+ <script [% script_nonce FILTER none %]>
assignToDefaultOnChange(['product', 'component'],
'[% bug.component_obj.default_assignee.login FILTER js %]',
'[% bug.component_obj.default_qa_contact.login FILTER js %]');
[% IF !bug_flags_set %]<em>None yet set</em>[% END %]
(<a href="#" id="bz_flags_more_action">[% IF !bug_flags_set %]set[% ELSE %]more[% END %] flags</a>)
</span>
- <script>
+ <script [% script_nonce FILTER none %]>
YAHOO.util.Dom.removeClass('bz_flags_more_container', 'bz_default_hidden');
var table = YAHOO.util.Dom.get("flags");
var rows = YAHOO.util.Dom.getElementsByClassName('bz_flag_type', 'tbody', table);
[% BLOCK summon_comment_box %]
<div id="comment_top_hat">
- <script>
+ <script [% script_nonce FILTER none %]>
function summonCommentBox() {
var commentbox = document.getElementById('add_comment');
document.getElementById('comment_top_hat').appendChild(commentbox);
<div id="con_calendar_[% field.name FILTER html %]"></div>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('[% field.name FILTER js %]')
</script>
[% CASE constants.FIELD_TYPE_BUG_ID %]
<span id="[% field.name FILTER html %]_edit_container" class="edit_me bz_default_hidden">
(<a href="#" id="[% field.name FILTER html %]_edit_action">edit</a>)
</span>
- <script>
+ <script [% script_nonce FILTER none %]>
hideEditableField('[% field.name FILTER js %]_edit_container',
'[% field.name FILTER js %]_input_area',
'[% field.name FILTER js %]_edit_action',
<input type="hidden" name="defined_[% field.name FILTER html %]">
[% END %]
- <script>
+ <script [% script_nonce FILTER none %]>
<!--
initHidingOptionsForIE('[% field.name FILTER js %]');
[%+ INCLUDE "bug/field-events.js.tmpl"
id = field.name name = field.name minrows = 4 maxrows = 8
cols = 60 defaultcontent = value mandatory = field.is_mandatory %]
</div>
- <script>
+ <script [% script_nonce FILTER none %]>
hideEditableField('[% field.name FILTER js %]_edit_container',
'[% field.name FILTER js %]_input',
'[% field.name FILTER js %]_edit_action',
[% IF !bug.id %]value="[% value FILTER html %]"[% END %]>
</div>
[% IF bug.id %]
- <script>
+ <script [% script_nonce FILTER none %]>
setupEditLink('[% field.name FILTER js %]');
</script>
[% END %]
name="[% field.name FILTER html %]"
data-values="[% field.name FILTER html %]"
value="[% value FILTER html %]">
- <script>
+ <script [% script_nonce FILTER none %]>
if (typeof BUGZILLA.autocomplete_values === 'undefined')
BUGZILLA.autocomplete_values = [];
BUGZILLA.autocomplete_values['[% field.name FILTER js %]'] = [
[% END %]
</div>
-<script>
+<script [% script_nonce FILTER none %]>
var close_status_array = [
[% FOREACH status = bug.choices.bug_status %]
[% NEXT IF status.is_open %]
</tr></table>
</form>
-<script>
+<script [% script_nonce FILTER none %]>
<!--
createCalendar('start_date');
createCalendar('end_date');
<input type="hidden" name="dontchange" value="[% dontchange FILTER html %]">
<input type="hidden" name="token" value="[% token FILTER html %]">
-<script>
+<script [% script_nonce FILTER none %]>
function SetCheckboxes(value) {
var elements = document.forms.changeform.getElementsByTagName('input'),
numelements = elements.length,
[% IF groups.size > 0 %]
- <script>
+ <script [% script_nonce FILTER none %]>
function turn_off(myself, id) {
var other_checkbox = document.getElementById(id);
if (myself.checked && other_checkbox) {
</select>
</span>
- <script>
+ <script [% script_nonce FILTER none %]>
var close_status_array = new Array("[% closed_status_array.join('", "') FILTER none %]");
YAHOO.util.Event.addListener('bug_status', "change", showHideStatusItems, '[% "is_duplicate" IF bug.dup_id %]');
YAHOO.util.Event.onDOMReady( showHideStatusItems );
[% END %]
</tbody>
</table>
- <script><!--
+ <script [% script_nonce FILTER none %]><!--
var numelements = document.forms.editform.elements.length;
function SetCheckboxes(value) {
var item;
[% END %]
</form>
-<script>
+<script [% script_nonce FILTER none %]>
Duo.init({
'host': '[% Param('duo_host') FILTER js %]',
'sig_request': '[% sig_request FILTER js %]',
donames = 1
%]
-<script>
+<script [% script_nonce FILTER none %]>
[%# This function takes necessary action on selection of a subcategory %]
function subcatSelected() {
var cat = document.chartform.category.value;
checkNewState();
}
+document.addEventListener("DOMContentLoaded", function(event) {
+ document.chartform.category.addEventListener("change", function (event) {
+ catSelected();
+ return subcatSelected();
+ });
+ document.chartform.subcategory.addEventListener("change", function (event) {
+ return subcatSelected();
+ });
+});
</script>
[% gttext = "Grand Total" %]
</th>
</tr>
<tr>
-
- [% PROCESS series_select sel = { name => 'category',
- size => 5,
- onchange = "catSelected();
- subcatSelected();" } %]
-
+
+ [% PROCESS series_select sel = { name => 'category',
+ size => 5 } %]
+
<td>
<noscript>
<input type="submit" name="action-assemble" value="Update -->"
id="action-assemble">
</noscript>
</td>
-
- [% PROCESS series_select sel = { name => 'subcategory',
- size => 5,
- onchange = "subcatSelected()" } %]
-
+
+ [% PROCESS series_select sel = { name => 'subcategory',
+ size => 5 } %]
+
<td>
<noscript>
<input type="submit" name="action-assemble" value="Update -->"
title = "$terms.Bugzilla Keyword Descriptions"
%]
-<script>
+<script [% script_nonce FILTER none %]>
$(document).ready(function () {
var show_inactive_keywords = [% show_inactive_keywords ? "true" : "false" FILTER none %],
link = $("#keywords_show_hide"),
[% urlbase = BLOCK %][% urlbase %]&[% tbl_field FILTER uri %]=[% tbl FILTER uri %][% END %]
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
function bz_encode (str, decode) {
// First decode HTML entities, if requested.
if (decode)
[% subcategory = category.${default.category} %]
[% name = subcategory.${default.subcategory} %]
-<script>
+<script [% script_nonce FILTER none %]>
[%# This structure holds details of the series the user can select from. %]
var series = {
[% FOREACH c = category.keys.sort %]
[% PROCESS "reports/series-common.html.tmpl"
newtext = "New (name below)"
%]
-
+
+<script [% script_nonce FILTER none %]>
+ document.addEventListener("DOMContentLoaded", function (event) {
+ if (document.chartform) {
+ document.chartform.category.addEventListener("change", (event) => catSelected());
+ document.chartform.subcategory.addEventListener("change", (event) => checkNewState());
+ }
+ });
+</script>
+
<table cellpadding="2" cellspacing="2" border="0"
style="text-align: left; margin-left: 20px">
<tbody>
</tr>
<tr>
[% PROCESS series_select sel = { name => 'category',
- size => 5,
- onchange => "catSelected()" } %]
+ size => 5 } %]
<td>
<noscript>
<input type="submit" name="action-edit" value="Update -->"
id="action-edit">
</noscript>
</td>
-
- [% PROCESS series_select sel = { name => 'subcategory',
- size => 5,
- onchange => "checkNewState()" } %]
-
+
+ [% PROCESS series_select sel = { name => 'subcategory',
+ size => 5 } %]
+
<td valign="top" name="name">
<input type="text" name="name" maxlength="64"
value="[% default.name.0 FILTER html %]" size="25">
style_urls = ['skins/standard/buglist.css']
%]
-<script>
+<script [% script_nonce FILTER none %]>
var useclassification = false; // No classification level in use
var first_load = true; // Is this the first time we load the page?
var last_sel = []; // Caches last selection
with_buttons = 1
condition = { f => 'noop' }
cond_num = cond_num + 1 %]
- <script>
+ <script [% script_nonce FILTER none %]>
TUI_alternates['custom_search_query'] = '►';
TUI_hide_default('custom_search_query');
TUI_alternates['custom_search_advanced'] = "Show Advanced Features";
</script>
<script src="[% 'js/custom-search.js' FILTER version %]"></script>
<script src="[% 'js/history.js/native.history.js' FILTER version %]"></script>
- <script>
+ <script [% script_nonce FILTER none %]>
redirect_html4_browsers();
[%# These are alternative labels for the AND and OR options in and_all_select %]
var cs_and_label = 'Match ALL of the following:';
[% IF onchange %] onchange="[% onchange FILTER html %]"[% END %]
value="[% value FILTER html %]"
data-values="[% field.name FILTER html %]">
- <script>
+ <script [% script_nonce FILTER none %]>
if (typeof BUGZILLA.autocomplete_values === 'undefined')
BUGZILLA.autocomplete_values = [];
BUGZILLA.autocomplete_values['[% field.name FILTER js %]'] = [
<small>(YYYY-MM-DD or relative dates)</small>
<span id="con_calendar_[% field.name FILTER html %]to"></span>
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('[% field.name FILTER js %]');
createCalendar('[% field.name FILTER js %]to');
</script>
[% PROCESS "global/field-descs.none.tmpl" %]
-<script>
+<script [% script_nonce FILTER none %]>
var first_load = true; [%# is this the first time we load the page? %]
var last_sel = new Array(); [%# caches last selection %]
onclick="showCalendar('chfieldto')"><span>Calendar</span></button>
<div id="con_calendar_chfieldto"></div>
(YYYY-MM-DD or relative dates)
- <script>
+ <script [% script_nonce FILTER none %]>
createCalendar('chfieldfrom');
createCalendar('chfieldto');
</script>
<input type="hidden" name="action" value="create">
<input type="hidden" name="token" value="[% issue_hash_token(['create-series']) FILTER html %]">
-<script>
+<script [% script_nonce FILTER none %]>
document.chartform.category[0].selected = true;
catSelected();
checkNewState();
[% default.product = [ 'Firefox' ] %]
[% END %]
-<script>
+<script [% script_nonce FILTER none %]>
YAHOO.bugzilla.instantSearch.setLabels( {
id: "[% field_descs.bug_id FILTER js %]",
summary: "[% field_descs.short_desc FILTER js %]",
[% terms.bugs %] using the rest of the form.
</p>
-<script><!--
+<script [% script_nonce FILTER none %]><!--
[%# The Y-axis fields are not used for pie charts %]
function chartTypeChanged() {
// format[2] is the pie chart radio button
projects / thirdparty / bugzilla.git / commitdiff
