Bug 1439797 - Enable reporting-only CSP by default

34 files changed, 100 insertions, 78 deletions

diff --git a/template/en/default/account/prefs/email.html.tmpl b/template/en/default/account/prefs/email.html.tmpl
index d09bffc5d..014bf4f3d 100644
--- a/template/en/default/account/prefs/email.html.tmpl
+++ b/template/en/default/account/prefs/email.html.tmpl
@@ -41,7 +41,7 @@
   filter some or all notifications.
 </p>
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
 function SetCheckboxes(setting) {
   for (var count = 0; count < document.userprefsform.elements.length; count++) {
diff --git a/template/en/default/account/prefs/saved-searches.html.tmpl b/template/en/default/account/prefs/saved-searches.html.tmpl
index 58448eb5e..426b593dc 100644
--- a/template/en/default/account/prefs/saved-searches.html.tmpl
+++ b/template/en/default/account/prefs/saved-searches.html.tmpl
@@ -25,7 +25,7 @@
   #%]
 
 [% IF user.can_bless %]
-  <script><!--
+  <script [% script_nonce FILTER none %]><!--
     function update_checkbox(group) {
       var bless_groups = [[% bless_group_ids.join(",") FILTER js %]];
       var checkbox = document.getElementById(group.name.replace(/share_(\d+)/, "force_$1"));
diff --git a/template/en/default/account/prefs/settings.html.tmpl b/template/en/default/account/prefs/settings.html.tmpl
index b09d7a491..c7208ff29 100644
--- a/template/en/default/account/prefs/settings.html.tmpl
+++ b/template/en/default/account/prefs/settings.html.tmpl
@@ -80,7 +80,7 @@
   </table>
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 $().ready(function() {
   var id = document.location.hash.substring(1) + '_row';
   $('#' + id).addClass('highlighted');
diff --git a/template/en/default/admin/custom_fields/create.html.tmpl b/template/en/default/admin/custom_fields/create.html.tmpl
index 41852de03..2b3f0eadb 100644
--- a/template/en/default/admin/custom_fields/create.html.tmpl
+++ b/template/en/default/admin/custom_fields/create.html.tmpl
@@ -32,7 +32,7 @@
 %]
 
 [%# set initial editability of fields such as Reverse Relationship Description %]
-<script>
+<script [% script_nonce FILTER none %]>
 YAHOO.util.Event.onDOMReady(function() {onChangeType(document.getElementById('type'))});
 </script>
 
diff --git a/template/en/default/admin/params/common.html.tmpl b/template/en/default/admin/params/common.html.tmpl
index 4941afa38..cd135e1d2 100644
--- a/template/en/default/admin/params/common.html.tmpl
+++ b/template/en/default/admin/params/common.html.tmpl
@@ -111,7 +111,7 @@
           </tr>
         </table>
 
-        <script>
+        <script [% script_nonce FILTER none %]>
             bz_toggleClass("input_[% param.name FILTER html %]", "bz_default_hidden");
             bz_toggleClass("table_[% param.name FILTER html %]", "bz_default_hidden");
         </script>
diff --git a/template/en/default/admin/workflow/comment.html.tmpl b/template/en/default/admin/workflow/comment.html.tmpl
index 9b447f777..8f64c77a6 100644
--- a/template/en/default/admin/workflow/comment.html.tmpl
+++ b/template/en/default/admin/workflow/comment.html.tmpl
@@ -21,7 +21,7 @@
    style_urls = ['skins/standard/admin.css']
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
   function toggle_cell(cell) {
     if (cell.checked)
diff --git a/template/en/default/admin/workflow/edit.html.tmpl b/template/en/default/admin/workflow/edit.html.tmpl
index 5646c294d..97bbec796 100644
--- a/template/en/default/admin/workflow/edit.html.tmpl
+++ b/template/en/default/admin/workflow/edit.html.tmpl
@@ -21,7 +21,7 @@
    style_urls = ['skins/standard/admin.css']
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
   function toggle_cell(cell) {
     if (cell.checked)
diff --git a/template/en/default/attachment/create.html.tmpl b/template/en/default/attachment/create.html.tmpl
index e058b3def..329e0ab49 100644
--- a/template/en/default/attachment/create.html.tmpl
+++ b/template/en/default/attachment/create.html.tmpl
@@ -39,7 +39,7 @@
   doc_section = "attachments.html"
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
 TUI_hide_default('attachment_text_field');
 -->
diff --git a/template/en/default/attachment/createformcontents.html.tmpl b/template/en/default/attachment/createformcontents.html.tmpl
index dc861b7a6..41a02a913 100644
--- a/template/en/default/attachment/createformcontents.html.tmpl
+++ b/template/en/default/attachment/createformcontents.html.tmpl
@@ -21,13 +21,22 @@
   #                 Marc Schumann <wurblzap@gmail.com>
   #%]
 
+<script [% script_nonce FILTER none %]>
+  document.addEventListener("DOMContentLoaded", function (event) {
+    document.querySelector("#attachment_data_controller").addEventListener(
+      "click", function (event) {
+        TUI_toggle_class('attachment_text_field');
+        TUI_toggle_class('attachment_data');
+      });
+  });
+</script>
+
 <tr class="attachment_data">
   <th><label for="data">File</label>:</th>
   <td>
     <em>Enter the path to the file on your computer</em> (or
-    <a id="attachment_data_controller" href="javascript:TUI_toggle_class('attachment_text_field');
-                                             javascript:TUI_toggle_class('attachment_data')"
-    >paste text as attachment</a>).<br>
+    <a id="attachment_data_controller">
+    paste text as attachment</a>).<br>
     <input type="file" id="data" name="data" size="50">
   </td>
 </tr>
@@ -58,7 +67,7 @@
     <input type="checkbox" id="ispatch" name="ispatch" value="1">
     <label for="ispatch">patch</label><br><br>
     [%# Reset this whenever the page loads so that the JS state is up to date %]
-    <script [% csp_nonce FILTER none %]>
+    <script [% script_nonce FILTER none %]>
       $(function() {
         $("#file").on("change", function() {
           DataFieldHandler();
diff --git a/template/en/default/attachment/diff-file.html.tmpl b/template/en/default/attachment/diff-file.html.tmpl
index 70fbf554c..d510b5a5e 100644
--- a/template/en/default/attachment/diff-file.html.tmpl
+++ b/template/en/default/attachment/diff-file.html.tmpl
@@ -45,7 +45,7 @@
     [% END %]
   [% END %]
 </td></tr></thead><tbody class="[% collapsed ? 'file_collapse' : 'file' %]">
-<script>
+<script [% script_nonce FILTER none %]>
 incremental_restore()
 </script>
 
diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl
index 43bf4c83c..d06d4ad56 100644
--- a/template/en/default/attachment/edit.html.tmpl
+++ b/template/en/default/attachment/edit.html.tmpl
@@ -219,7 +219,7 @@
                   <a href="attachment.cgi?id=[% attachment.id %]">View the attachment on a separate page</a>.</b>
                 </iframe>
               [% END %]
-              <script>
+              <script [% script_nonce FILTER none %]>
                 <!--
                 var patchviewerinstalled = 0;
                 var attachment_id = [% attachment.id %];
@@ -328,7 +328,7 @@
   [% END %]
 </div>
 [% IF can_edit %]
-  <script>
+  <script [% script_nonce FILTER none %]>
     <!--
       YAHOO.util.Dom.removeClass( document.body, "no_javascript" );
       toggle_attachment_details_visibility( );
diff --git a/template/en/default/attachment/list.html.tmpl b/template/en/default/attachment/list.html.tmpl
index 50800dd8e..16e94586c 100644
--- a/template/en/default/attachment/list.html.tmpl
+++ b/template/en/default/attachment/list.html.tmpl
@@ -19,7 +19,7 @@
   #                 Frédéric Buclin <LpSolit@gmail.com>
   #%]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
 function toggle_display(link) {
     var table = document.getElementById("attachment_table");
diff --git a/template/en/default/bug/comments.html.tmpl b/template/en/default/bug/comments.html.tmpl
index 2346983b2..7af08efde 100644
--- a/template/en/default/bug/comments.html.tmpl
+++ b/template/en/default/bug/comments.html.tmpl
@@ -25,7 +25,7 @@
 <script src="[% 'js/comments.js' FILTER version %]">
 </script>
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
   /* Adds the reply text to the 'comment' textarea */
   function replyToComment(id, real_id, name) {
@@ -191,13 +191,13 @@
             [% IF comment.collapsed %]
               </span>
             [% END %]
-            <script>
+            <script [% script_nonce FILTER none %]>
               addCollapseLink([% comment.count %], [% comment.collapsed FILTER js %], 'Toggle comment display');
             </script>
           </span>
         [% ELSIF comment.collapsed %]
           <span class="bz_comment_actions">
-            <script>
+            <script [% script_nonce FILTER none %]>
               addCollapseLink([% comment.count %], [% comment.collapsed FILTER js %], 'Toggle comment display');
             </script>
           </span>
@@ -270,7 +270,7 @@
                    [% " bz_default_hidden" UNLESS comment.tags.size %]">
           <span id="ct_[% comment.count %]">
             [% IF comment.tags.size %]
-              <script>
+              <script [% script_nonce FILTER none %]>
                 YAHOO.bugzilla.commentTagging.showTags([% comment.id FILTER none %],
                   [% comment.count FILTER none %], [
                 [% FOREACH tag = comment.tags %]
diff --git a/template/en/default/bug/create/create-guided.html.tmpl b/template/en/default/bug/create/create-guided.html.tmpl
index 9420f1330..a1c2c2e08 100644
--- a/template/en/default/bug/create/create-guided.html.tmpl
+++ b/template/en/default/bug/create/create-guided.html.tmpl
@@ -41,7 +41,7 @@
 [% tablecolour = "#FFFFCC" %]
 
 [%# This script displays the descriptions for selected components. %]
-<script>
+<script [% script_nonce FILTER none %]>
 var descriptions = [
 [% FOREACH c = product.components %]
   '[% c.description FILTER js %]',
@@ -181,7 +181,7 @@ function PutDescription() {
           <td valign="top" width="100%">
               <div id="description" style="color: green; margin-left: 10px;
                                            height: 5em; overflow: auto;">
-                <script>
+                <script [% script_nonce FILTER none %]>
                   if ((document.getElementById) && (document.body.innerHTML)) {
                     document.write("\
                     Select a component to see its description here.");
diff --git a/template/en/default/bug/create/create.html.tmpl b/template/en/default/bug/create/create.html.tmpl
index 567c58d58..3185374e5 100644
--- a/template/en/default/bug/create/create.html.tmpl
+++ b/template/en/default/bug/create/create.html.tmpl
@@ -40,7 +40,7 @@
   onload = "init();"
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
 
 function init() {
@@ -217,7 +217,7 @@ TUI_hide_default('attachment_text_field');
       <input type="button" id="expert_fields_controller"
              value="Hide Advanced Fields" onClick="toggleAdvancedFields()">
       [%# Show the link if the browser supports JS %]
-      <script>
+      <script [% script_nonce FILTER none %]>
         YAHOO.util.Dom.removeClass('expert_fields_controller',
                                    'bz_default_hidden');
       </script>
@@ -276,7 +276,7 @@ TUI_hide_default('attachment_text_field');
         [%- END %]
       </select>
 
-      <script>
+      <script [% script_nonce FILTER none %]>
        <!--
          [%+ INCLUDE "bug/field-events.js.tmpl"
                      field = bug_fields.component, product = product %]
@@ -492,7 +492,7 @@ TUI_hide_default('attachment_text_field');
       <th>Possible<br>Duplicates:</th>
       <td colspan="3">
         <div id="possible_duplicates"></div>
-        <script>
+        <script [% script_nonce FILTER none %]>
           var dt_columns = [
               { key: "id", label: "[% field_descs.bug_id FILTER js %]",
                 formatter: YAHOO.bugzilla.dupTable.formatBugLink },
diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index 84a20b97e..b424d5542 100644
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -49,7 +49,7 @@
     </div>
   [% END %]
   [% IF user.id %]
-    <script>
+    <script [% script_nonce FILTER none %]>
       YAHOO.bugzilla.commentTagging.init([% user.can_tag_comments ? 'true' : 'false' %]);
       YAHOO.bugzilla.commentTagging.min_len = [% constants.MIN_COMMENT_TAG_LENGTH FILTER js %];
       YAHOO.bugzilla.commentTagging.max_len = [% constants.MAX_COMMENT_TAG_LENGTH FILTER js %];
@@ -64,7 +64,7 @@
   [% END %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
 [% IF user.is_timetracker %]
   var fRemainingTime = [% bug.remaining_time %]; // holds the original value
@@ -300,7 +300,7 @@
       </table>
     </div>
   </div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     hideAliasAndSummary('[% bug.short_desc FILTER js %]', '[% bug.alias FILTER js %]');
   </script>
 [% END %]
@@ -591,7 +591,7 @@
     [%# BMO - hook for adding mentors %]
     [% Hook.process("after_people", "bug/edit.html.tmpl") %]
 
-    <script>
+    <script [% script_nonce FILTER none %]>
       assignToDefaultOnChange(['product', 'component'],
         '[% bug.component_obj.default_assignee.login FILTER js %]',
         '[% bug.component_obj.default_qa_contact.login FILTER js %]');
@@ -998,7 +998,7 @@
             [% IF !bug_flags_set %]<em>None yet set</em>[% END %]
             (<a href="#" id="bz_flags_more_action">[% IF !bug_flags_set %]set[% ELSE %]more[% END %] flags</a>)
           </span>
-          <script>
+          <script [% script_nonce FILTER none %]>
             YAHOO.util.Dom.removeClass('bz_flags_more_container', 'bz_default_hidden');
             var table = YAHOO.util.Dom.get("flags");
             var rows = YAHOO.util.Dom.getElementsByClassName('bz_flag_type', 'tbody', table);
@@ -1248,7 +1248,7 @@
 
 [% BLOCK summon_comment_box %]
 <div id="comment_top_hat">
-  <script>
+  <script [% script_nonce FILTER none %]>
     function summonCommentBox() {
         var commentbox = document.getElementById('add_comment');
         document.getElementById('comment_top_hat').appendChild(commentbox);
diff --git a/template/en/default/bug/field.html.tmpl b/template/en/default/bug/field.html.tmpl
index b9bee6de3..1d6048cdd 100644
--- a/template/en/default/bug/field.html.tmpl
+++ b/template/en/default/bug/field.html.tmpl
@@ -74,7 +74,7 @@
 
       <div id="con_calendar_[% field.name FILTER html %]"></div>
 
-      <script>
+      <script [% script_nonce FILTER none %]>
         createCalendar('[% field.name FILTER js %]')
       </script>
     [% CASE constants.FIELD_TYPE_BUG_ID %]
@@ -91,7 +91,7 @@
         <span id="[% field.name FILTER html %]_edit_container" class="edit_me bz_default_hidden">
           (<a href="#" id="[% field.name FILTER html %]_edit_action">edit</a>)
         </span>
-        <script>
+        <script [% script_nonce FILTER none %]>
         hideEditableField('[% field.name FILTER js %]_edit_container',
                           '[% field.name FILTER js %]_input_area',
                           '[% field.name FILTER js %]_edit_action',
@@ -175,7 +175,7 @@
           <input type="hidden" name="defined_[% field.name FILTER html %]">
         [% END %]
 
-        <script>
+        <script [% script_nonce FILTER none %]>
         <!--
           initHidingOptionsForIE('[% field.name FILTER js %]');
           [%+ INCLUDE "bug/field-events.js.tmpl"
@@ -197,7 +197,7 @@
             id = field.name name = field.name minrows = 4 maxrows = 8
             cols = 60 defaultcontent = value mandatory = field.is_mandatory %]
        </div>
-       <script>
+       <script [% script_nonce FILTER none %]>
          hideEditableField('[% field.name FILTER js %]_edit_container',
                            '[% field.name FILTER js %]_input',
                            '[% field.name FILTER js %]_edit_action',
@@ -230,7 +230,7 @@
                   [% IF !bug.id %]value="[% value FILTER html %]"[% END %]>
          </div>
          [% IF bug.id %]
-           <script>
+           <script [% script_nonce FILTER none %]>
              setupEditLink('[% field.name FILTER js %]');
            </script>
          [% END %]
@@ -241,7 +241,7 @@
               name="[% field.name FILTER html %]"
               data-values="[% field.name FILTER html %]"
               value="[% value FILTER html %]">
-       <script>
+       <script [% script_nonce FILTER none %]>
           if (typeof BUGZILLA.autocomplete_values === 'undefined')
             BUGZILLA.autocomplete_values = [];
           BUGZILLA.autocomplete_values['[% field.name FILTER js %]'] = [
diff --git a/template/en/default/bug/knob.html.tmpl b/template/en/default/bug/knob.html.tmpl
index a0a5dc647..16aa160f6 100644
--- a/template/en/default/bug/knob.html.tmpl
+++ b/template/en/default/bug/knob.html.tmpl
@@ -70,7 +70,7 @@
   [% END %]
 </div>
 
-<script>
+<script [% script_nonce FILTER none %]>
   var close_status_array = [
     [% FOREACH status = bug.choices.bug_status %]
       [% NEXT IF status.is_open %]
diff --git a/template/en/default/bug/summarize-time.html.tmpl b/template/en/default/bug/summarize-time.html.tmpl
index 120bd74ad..9f2742694 100644
--- a/template/en/default/bug/summarize-time.html.tmpl
+++ b/template/en/default/bug/summarize-time.html.tmpl
@@ -341,7 +341,7 @@
 </tr></table>
 
 </form>
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
   createCalendar('start_date');
   createCalendar('end_date');
diff --git a/template/en/default/list/edit-multiple.html.tmpl b/template/en/default/list/edit-multiple.html.tmpl
index 427acba37..eb989d15c 100644
--- a/template/en/default/list/edit-multiple.html.tmpl
+++ b/template/en/default/list/edit-multiple.html.tmpl
@@ -28,7 +28,7 @@
 <input type="hidden" name="dontchange" value="[% dontchange FILTER html %]">
 <input type="hidden" name="token" value="[% token FILTER html %]">
 
-<script>
+<script [% script_nonce FILTER none %]>
   function SetCheckboxes(value) {
       var elements = document.forms.changeform.getElementsByTagName('input'),
           numelements = elements.length,
@@ -328,7 +328,7 @@
 
 [% IF groups.size > 0 %]
 
-  <script>
+  <script [% script_nonce FILTER none %]>
     function turn_off(myself, id) {
         var other_checkbox = document.getElementById(id);
         if (myself.checked && other_checkbox) {
@@ -443,7 +443,7 @@
   </select>
   </span>
 
-  <script>
+  <script [% script_nonce FILTER none %]>
   var close_status_array = new Array("[% closed_status_array.join('", "') FILTER none %]");
     YAHOO.util.Event.addListener('bug_status', "change", showHideStatusItems, '[% "is_duplicate" IF bug.dup_id %]');
     YAHOO.util.Event.onDOMReady( showHideStatusItems );
diff --git a/template/en/default/list/quips.html.tmpl b/template/en/default/list/quips.html.tmpl
index 671722c85..8714fec7d 100644
--- a/template/en/default/list/quips.html.tmpl
+++ b/template/en/default/list/quips.html.tmpl
@@ -140,7 +140,7 @@
         [% END %]
         </tbody>
       </table>
-      <script><!--
+      <script [% script_nonce FILTER none %]><!--
         var numelements = document.forms.editform.elements.length;
         function SetCheckboxes(value) {
           var item;
diff --git a/template/en/default/mfa/duo/verify.html.tmpl b/template/en/default/mfa/duo/verify.html.tmpl
index 799efba7b..f3f49657a 100644
--- a/template/en/default/mfa/duo/verify.html.tmpl
+++ b/template/en/default/mfa/duo/verify.html.tmpl
@@ -84,7 +84,7 @@ $(function() {
   [% END %]
 </form>
 
-<script>
+<script [% script_nonce FILTER none %]>
   Duo.init({
     'host': '[% Param('duo_host') FILTER js %]',
     'sig_request': '[% sig_request FILTER js %]',
diff --git a/template/en/default/reports/create-chart.html.tmpl b/template/en/default/reports/create-chart.html.tmpl
index 1e6945ebc..e20d8522f 100644
--- a/template/en/default/reports/create-chart.html.tmpl
+++ b/template/en/default/reports/create-chart.html.tmpl
@@ -33,7 +33,7 @@
   donames = 1 
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 [%# This function takes necessary action on selection of a subcategory %]
 function subcatSelected() {
   var cat = document.chartform.category.value;
@@ -55,6 +55,15 @@ function subcatSelected() {
   
   checkNewState();
 }
+document.addEventListener("DOMContentLoaded", function(event) {
+  document.chartform.category.addEventListener("change", function (event) {
+    catSelected();
+    return subcatSelected();
+  });
+  document.chartform.subcategory.addEventListener("change", function (event) {
+    return subcatSelected();
+  });
+});
 </script>
   
 [% gttext = "Grand Total" %]
@@ -79,23 +88,20 @@ function subcatSelected() {
         </th>
       </tr>
       <tr>
-      
-        [% PROCESS series_select sel = { name => 'category', 
-                                         size => 5,
-                                         onchange = "catSelected();
-                                                     subcatSelected();" } %]
-                                   
+
+        [% PROCESS series_select sel = { name => 'category',
+                                         size => 5 } %]
+
         <td>
           <noscript>
             <input type="submit" name="action-assemble" value="Update --&gt;"
                    id="action-assemble">
           </noscript>
         </td>
-        
-        [% PROCESS series_select sel = { name => 'subcategory', 
-                                         size => 5,
-                                         onchange = "subcatSelected()" } %]
-                                   
+
+        [% PROCESS series_select sel = { name => 'subcategory',
+                                         size => 5 } %]
+
         <td>
           <noscript>
             <input type="submit" name="action-assemble" value="Update --&gt;"
diff --git a/template/en/default/reports/keywords.html.tmpl b/template/en/default/reports/keywords.html.tmpl
index 97a2d44d2..491bac78e 100644
--- a/template/en/default/reports/keywords.html.tmpl
+++ b/template/en/default/reports/keywords.html.tmpl
@@ -34,7 +34,7 @@
   title = "$terms.Bugzilla Keyword Descriptions"
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
  $(document).ready(function () {
      var show_inactive_keywords = [% show_inactive_keywords ? "true" : "false" FILTER none %],
          link = $("#keywords_show_hide"),
diff --git a/template/en/default/reports/report-table.html.tmpl b/template/en/default/reports/report-table.html.tmpl
index e8f926f64..096eb171a 100644
--- a/template/en/default/reports/report-table.html.tmpl
+++ b/template/en/default/reports/report-table.html.tmpl
@@ -46,7 +46,7 @@
   [% urlbase = BLOCK %][% urlbase %]&amp;[% tbl_field FILTER uri %]=[% tbl FILTER uri %][% END %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 function bz_encode (str, decode) {
   // First decode HTML entities, if requested.
   if (decode)
diff --git a/template/en/default/reports/series-common.html.tmpl b/template/en/default/reports/series-common.html.tmpl
index 469eb79c5..b8032255d 100644
--- a/template/en/default/reports/series-common.html.tmpl
+++ b/template/en/default/reports/series-common.html.tmpl
@@ -29,7 +29,7 @@
 [% subcategory = category.${default.category} %]
 [% name = subcategory.${default.subcategory} %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 [%# This structure holds details of the series the user can select from. %]
 var series = {
 [% FOREACH c = category.keys.sort %]
diff --git a/template/en/default/reports/series.html.tmpl b/template/en/default/reports/series.html.tmpl
index 3cf939003..164c30355 100644
--- a/template/en/default/reports/series.html.tmpl
+++ b/template/en/default/reports/series.html.tmpl
@@ -29,7 +29,16 @@
 [% PROCESS "reports/series-common.html.tmpl"
    newtext = "New (name below)" 
  %]
-  
+
+<script [% script_nonce FILTER none %]>
+  document.addEventListener("DOMContentLoaded", function (event) {
+    if (document.chartform) {
+      document.chartform.category.addEventListener("change", (event) => catSelected());
+      document.chartform.subcategory.addEventListener("change", (event) => checkNewState());
+    }
+  });
+</script>
+
 <table cellpadding="2" cellspacing="2" border="0"
        style="text-align: left; margin-left: 20px">
   <tbody>
@@ -42,19 +51,17 @@
     </tr>
     <tr>
       [% PROCESS series_select sel = { name => 'category',
-                                       size => 5,
-                                       onchange => "catSelected()" } %]
+                                       size => 5 } %]
         <td>
           <noscript>
             <input type="submit" name="action-edit" value="Update --&gt;"
                    id="action-edit">
           </noscript>
         </td>
-        
-      [% PROCESS series_select sel = { name => 'subcategory', 
-                                       size => 5,
-                                       onchange => "checkNewState()" } %]
-        
+
+      [% PROCESS series_select sel = { name => 'subcategory',
+                                       size => 5 } %]
+
       <td valign="top" name="name">
         <input type="text" name="name" maxlength="64" 
                value="[% default.name.0 FILTER html %]" size="25">
diff --git a/template/en/default/request/queue.html.tmpl b/template/en/default/request/queue.html.tmpl
index d40281f50..c4b48b024 100644
--- a/template/en/default/request/queue.html.tmpl
+++ b/template/en/default/request/queue.html.tmpl
@@ -31,7 +31,7 @@
   style_urls = ['skins/standard/buglist.css']
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   var useclassification = false; // No classification level in use
   var first_load = true; // Is this the first time we load the page?
   var last_sel = []; // Caches last selection
diff --git a/template/en/default/search/boolean-charts.html.tmpl b/template/en/default/search/boolean-charts.html.tmpl
index 455cb48b8..767ea7563 100644
--- a/template/en/default/search/boolean-charts.html.tmpl
+++ b/template/en/default/search/boolean-charts.html.tmpl
@@ -70,7 +70,7 @@
     with_buttons = 1
     condition = { f => 'noop' }
     cond_num = cond_num + 1 %]
-  <script>
+  <script [% script_nonce FILTER none %]>
     TUI_alternates['custom_search_query'] = '&#9658;';
     TUI_hide_default('custom_search_query');
     TUI_alternates['custom_search_advanced'] = "Show Advanced Features";
@@ -78,7 +78,7 @@
   </script>
   <script src="[% 'js/custom-search.js' FILTER version %]"></script>
   <script src="[% 'js/history.js/native.history.js' FILTER version %]"></script>
-  <script>
+  <script [% script_nonce FILTER none %]>
     redirect_html4_browsers();
     [%# These are alternative labels for the AND and OR options in and_all_select %]
     var cs_and_label = 'Match ALL of the following:';
diff --git a/template/en/default/search/field.html.tmpl b/template/en/default/search/field.html.tmpl
index 0d10d4f6b..456cf088a 100644
--- a/template/en/default/search/field.html.tmpl
+++ b/template/en/default/search/field.html.tmpl
@@ -63,7 +63,7 @@
            [% IF onchange %] onchange="[% onchange FILTER html %]"[% END %]
            value="[% value FILTER html %]"
            data-values="[% field.name FILTER html %]">
-    <script>
+    <script [% script_nonce FILTER none %]>
       if (typeof BUGZILLA.autocomplete_values === 'undefined')
         BUGZILLA.autocomplete_values = [];
       BUGZILLA.autocomplete_values['[% field.name FILTER js %]'] = [
@@ -100,7 +100,7 @@
     <small>(YYYY-MM-DD or relative dates)</small>
     
     <span id="con_calendar_[% field.name FILTER html %]to"></span>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('[% field.name FILTER js %]');
       createCalendar('[% field.name FILTER js %]to');
     </script>
diff --git a/template/en/default/search/form.html.tmpl b/template/en/default/search/form.html.tmpl
index 49c311806..4d78a53da 100644
--- a/template/en/default/search/form.html.tmpl
+++ b/template/en/default/search/form.html.tmpl
@@ -23,7 +23,7 @@
 
 [% PROCESS "global/field-descs.none.tmpl" %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 
 var first_load = true;         [%# is this the first time we load the page? %]
 var last_sel = new Array();    [%# caches last selection %]
@@ -394,7 +394,7 @@ TUI_hide_default('information_query');
                          onclick="showCalendar('chfieldto')"><span>Calendar</span></button>
           <div id="con_calendar_chfieldto"></div>
     (YYYY-MM-DD or relative dates)
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('chfieldfrom');
       createCalendar('chfieldto');
     </script>
diff --git a/template/en/default/search/search-create-series.html.tmpl b/template/en/default/search/search-create-series.html.tmpl
index 335448de9..e0b7ff562 100644
--- a/template/en/default/search/search-create-series.html.tmpl
+++ b/template/en/default/search/search-create-series.html.tmpl
@@ -56,7 +56,7 @@
   <input type="hidden" name="action" value="create">
   <input type="hidden" name="token" value="[% issue_hash_token(['create-series']) FILTER html %]">
 
-<script>
+<script [% script_nonce FILTER none %]>
   document.chartform.category[0].selected = true;
   catSelected();
   checkNewState();
diff --git a/template/en/default/search/search-instant.html.tmpl b/template/en/default/search/search-instant.html.tmpl
index 01af804fc..d0cf078e7 100644
--- a/template/en/default/search/search-instant.html.tmpl
+++ b/template/en/default/search/search-instant.html.tmpl
@@ -19,7 +19,7 @@
   [% default.product = [ 'Firefox' ] %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 YAHOO.bugzilla.instantSearch.setLabels( {
   id: "[% field_descs.bug_id FILTER js %]",
   summary: "[% field_descs.short_desc FILTER js %]",
diff --git a/template/en/default/search/search-report-graph.html.tmpl b/template/en/default/search/search-report-graph.html.tmpl
index df9c9e8ad..57ca8a8e9 100644
--- a/template/en/default/search/search-report-graph.html.tmpl
+++ b/template/en/default/search/search-report-graph.html.tmpl
@@ -46,7 +46,7 @@ var queryform = "reportform"
   [% terms.bugs %] using the rest of the form.
 </p>
 
-<script><!--
+<script [% script_nonce FILTER none %]><!--
   [%# The Y-axis fields are not used for pie charts %]
   function chartTypeChanged() {
     // format[2] is the pie chart radio button