From 6a727b70a9f7d3deb690dffd818d7bb5e9eb7bf5 Mon Sep 17 00:00:00 2001
From: Dylan William Hardison <dylan@hardison.net>
Date: Wed, 25 Jan 2017 15:04:07 -0500
Subject: Bug 1286290 - CSP compliant bug modal

---
 .../default/hook/account/auth/login-additional_methods.html.tmpl   | 2 +-
 .../hook/account/auth/login-small-additional_methods.html.tmpl     | 4 ++--
 .../en/default/hook/account/create-additional_methods.html.tmpl    | 2 +-
 .../en/default/hook/global/header-additional_header.html.tmpl      | 7 +++++--
 4 files changed, 9 insertions(+), 6 deletions(-)

(limited to 'extensions/Persona/template/en')

diff --git a/extensions/Persona/template/en/default/hook/account/auth/login-additional_methods.html.tmpl b/extensions/Persona/template/en/default/hook/account/auth/login-additional_methods.html.tmpl
index c964f9fed..1743db9a6 100644
--- a/extensions/Persona/template/en/default/hook/account/auth/login-additional_methods.html.tmpl
+++ b/extensions/Persona/template/en/default/hook/account/auth/login-additional_methods.html.tmpl
@@ -1,7 +1,7 @@
 [% IF Param('user_info_class').split(',').contains('Persona')
       && Param('persona_includejs_url') %]
 <p>
-  <img src="extensions/Persona/web/images/persona_sign_in.png" width="185" height="25" onclick="persona_sign_in()">
+  <img src="extensions/Persona/web/images/persona_sign_in.png" width="185" height="25" class="persona_sign_in">
 </p>
 <p>
   <strong>Note:</strong> Persona authentication will be removed on October 25th, 2016 (<a href="page.cgi?id=persona_deprecated.html">more info</a>).
diff --git a/extensions/Persona/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl b/extensions/Persona/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl
index 5d8503d73..17a86a71d 100644
--- a/extensions/Persona/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl
+++ b/extensions/Persona/template/en/default/hook/account/auth/login-small-additional_methods.html.tmpl
@@ -1,6 +1,6 @@
 [% IF Param('user_info_class').split(',').contains('Persona')
       && Param('persona_includejs_url') %]
-<script type="text/javascript">
+<script [% script_nonce FILTER none %] type="text/javascript">
   YAHOO.util.Event.addListener('login_link[% qs_suffix FILTER js %]','click', function () {
       var login_link = YAHOO.util.Dom.get('persona_mini_login[% qs_suffix FILTER js %]');
       YAHOO.util.Dom.removeClass(login_link, 'bz_default_hidden');
@@ -12,6 +12,6 @@
 </script>
 <span id="persona_mini_login[% qs_suffix FILTER html %]" class="bz_default_hidden">
   <img src="extensions/Persona/web/images/sign_in.png" height="22" width="75" align="absmiddle"
-       title="Sign in with Persona" onclick="persona_sign_in()"> or
+       title="Sign in with Persona" class='persona_sign_in'> or
 </span>
 [% END %]
diff --git a/extensions/Persona/template/en/default/hook/account/create-additional_methods.html.tmpl b/extensions/Persona/template/en/default/hook/account/create-additional_methods.html.tmpl
index 355ce3629..b6fb1eedc 100644
--- a/extensions/Persona/template/en/default/hook/account/create-additional_methods.html.tmpl
+++ b/extensions/Persona/template/en/default/hook/account/create-additional_methods.html.tmpl
@@ -9,5 +9,5 @@
 [% RETURN UNLESS Param('user_info_class').split(',').contains('Persona') %]
 
 Or, use your Persona account:
-<img src="extensions/Persona/web/images/sign_in.png" onclick="persona_sign_in()"
+<img src="extensions/Persona/web/images/sign_in.png" class="persona_sign_in"
      width="95" height="25" align="absmiddle">
diff --git a/extensions/Persona/template/en/default/hook/global/header-additional_header.html.tmpl b/extensions/Persona/template/en/default/hook/global/header-additional_header.html.tmpl
index 5b2fa043b..12282df16 100644
--- a/extensions/Persona/template/en/default/hook/global/header-additional_header.html.tmpl
+++ b/extensions/Persona/template/en/default/hook/global/header-additional_header.html.tmpl
@@ -17,8 +17,8 @@
 [% USE Bugzilla %]
 [% cgi = Bugzilla.cgi %]
 
-<script defer src="[% Param('persona_includejs_url') %]" type="text/javascript"></script>
-<script type="text/javascript">
+<script [% script_nonce FILTER none %] defer src="[% Param('persona_includejs_url') %]" type="text/javascript"></script>
+<script [% script_nonce FILTER none %] type="text/javascript">
 
 function createHidden(name, value, form) {
   var field = document.createElement('input');
@@ -84,4 +84,7 @@ function persona_sign_in() {
   persona_ignore_login = false;
   navigator.id.request({ siteName: '[% terms.BugzillaTitle FILTER js %]' });
 }
+$(function() {
+    $('.persona_sign_in').on("click", persona_sign_in);
+});
 </script>
-- 
cgit v1.2.3-24-g4f1b