From d435e0a5b0e07c145f929457313d8d7738f42b14 Mon Sep 17 00:00:00 2001
From: Dylan William Hardison <dylan@hardison.net>
Date: Wed, 21 Feb 2018 13:59:53 -0500
Subject: Bug 1439797 - Enable reporting-only CSP by default

---
 extensions/BMO/template/en/default/account/create.html.tmpl         | 2 +-
 .../BMO/template/en/default/bug/create/create-automative.html.tmpl  | 4 ++--
 .../BMO/template/en/default/bug/create/create-creative.html.tmpl    | 2 +-
 .../BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl  | 2 +-
 .../BMO/template/en/default/bug/create/create-mozlist.html.tmpl     | 2 +-
 .../BMO/template/en/default/bug/create/create-mozpr.html.tmpl       | 6 +++---
 extensions/BMO/template/en/default/bug/create/create-swag.html.tmpl | 2 +-
 .../template/en/default/bug/create/create-user-engagement.html.tmpl | 2 +-
 .../en/default/hook/admin/products/edit-common-rows.html.tmpl       | 2 +-
 .../BMO/template/en/default/hook/attachment/edit-view.html.tmpl     | 2 +-
 .../template/en/default/hook/bug/comments-a_comment-end.html.tmpl   | 2 +-
 .../template/en/default/hook/bug/comments-aftercomments.html.tmpl   | 2 +-
 .../template/en/default/hook/bug/comments-comment_banner.html.tmpl  | 2 +-
 .../template/en/default/hook/bug/edit-after_importance.html.tmpl    | 2 +-
 .../BMO/template/en/default/hook/bug/edit-custom_field.html.tmpl    | 2 +-
 .../BMO/template/en/default/pages/attachment_bounty_form.html.tmpl  | 6 +++---
 .../BMO/template/en/default/pages/release_tracking_report.html.tmpl | 2 +-
 extensions/BMO/template/en/default/pages/triage_reports.html.tmpl   | 2 +-
 extensions/BMO/template/en/default/pages/user_activity.html.tmpl    | 2 +-
 .../template/en/default/account/prefs/bugmail_filter.html.tmpl      | 2 +-
 .../template/en/default/account/prefs/component_watch.html.tmpl     | 4 ++--
 .../en/default/hook/admin/components/edit-common-rows.html.tmpl     | 2 +-
 extensions/EditTable/template/en/default/pages/edit_table.html.tmpl | 2 +-
 .../template/en/default/flag/default_requestees.html.tmpl           | 2 +-
 .../FlagTypeComment/template/en/default/flag/type_comment.html.tmpl | 2 +-
 .../GuidedBugEntry/template/en/default/guided/guided.html.tmpl      | 4 ++--
 .../template/en/default/hook/bug/comments-aftercomments.html.tmpl   | 2 +-
 .../MyDashboard/template/en/default/pages/mydashboard.html.tmpl     | 2 +-
 .../default/hook/attachment/edit-after_comment_textarea.html.tmpl   | 2 +-
 extensions/Push/template/en/default/pages/push_config.html.tmpl     | 4 ++--
 .../template/en/default/bug/create/create-remo-budget.html.tmpl     | 4 ++--
 .../REMO/template/en/default/bug/create/create-remo-it.html.tmpl    | 2 +-
 .../REMO/template/en/default/bug/create/create-remo-swag.html.tmpl  | 2 +-
 .../REMO/template/en/default/pages/remo-form-payment.html.tmpl      | 2 +-
 .../Review/template/en/default/hook/attachment/create-end.html.tmpl | 2 +-
 .../Review/template/en/default/hook/attachment/edit-end.html.tmpl   | 2 +-
 .../Review/template/en/default/hook/bug/create/create-end.html.tmpl | 2 +-
 .../Review/template/en/default/hook/bug/edit-after_people.html.tmpl | 2 +-
 .../Review/template/en/default/hook/flag/list-requestee.html.tmpl   | 2 +-
 .../Review/template/en/default/pages/review_history.html.tmpl       | 2 +-
 .../template/en/default/hook/admin/users/userdata-end.html.tmpl     | 2 +-
 extensions/Splinter/template/en/default/pages/splinter.html.tmpl    | 4 ++--
 .../TrackingFlags/template/en/default/bug/tracking_flags.html.tmpl  | 4 ++--
 .../template/en/default/hook/bug/create/create-form.html.tmpl       | 2 +-
 .../template/en/default/hook/bug/edit-after_custom_fields.html.tmpl | 2 +-
 .../template/en/default/hook/bug/field-editable.html.tmpl           | 2 +-
 .../template/en/default/pages/tracking_flags_admin_edit.html.tmpl   | 2 +-
 .../template/en/default/hook/bug/comments-comment_banner.html.tmpl  | 4 ++--
 .../en/default/hook/bug/create/create-after_custom_fields.html.tmpl | 2 +-
 .../en/default/hook/admin/products/edit-common-rows.html.tmpl       | 2 +-
 50 files changed, 62 insertions(+), 62 deletions(-)

(limited to 'extensions')

diff --git a/extensions/BMO/template/en/default/account/create.html.tmpl b/extensions/BMO/template/en/default/account/create.html.tmpl
index d29303104..10d5fb5c1 100644
--- a/extensions/BMO/template/en/default/account/create.html.tmpl
+++ b/extensions/BMO/template/en/default/account/create.html.tmpl
@@ -38,7 +38,7 @@
    style_urls = [ 'extensions/BMO/web/styles/create_account.css' ]
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 function onSubmit() {
   var email = document.getElementById('login').value;
   var agreed = document.getElementById('etiquette').checked;
diff --git a/extensions/BMO/template/en/default/bug/create/create-automative.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-automative.html.tmpl
index a29f1f4f2..d1ed4b4b5 100644
--- a/extensions/BMO/template/en/default/bug/create/create-automative.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-automative.html.tmpl
@@ -182,7 +182,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_prototype_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('prototype_date')
     </script>
   </div>
@@ -200,7 +200,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_production_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('production_date')
     </script>
   </div>
diff --git a/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl
index 13620d1c4..eac24e53e 100644
--- a/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl
@@ -209,7 +209,7 @@ function toggleTypeOther(element) {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_launch_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('launch_date')
   </script>
 </div>
diff --git a/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl
index 942b37afa..d97d95b2a 100644
--- a/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl
@@ -139,7 +139,7 @@ function validateAndSubmit() {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_cf_due_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('cf_due_date')
   </script>
 </div>
diff --git a/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl
index ab03523ae..841477099 100644
--- a/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl
@@ -16,7 +16,7 @@
    style = ".mandatory{color:red;font-size:80%;}"
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
     function trySubmit() {
         var alert_text = "";
diff --git a/extensions/BMO/template/en/default/bug/create/create-mozpr.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-mozpr.html.tmpl
index 2d590fcfc..d2b1c1f08 100644
--- a/extensions/BMO/template/en/default/bug/create/create-mozpr.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-mozpr.html.tmpl
@@ -327,7 +327,7 @@ function validate_form() {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_start_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('start_date')
   </script>
 </div>
@@ -341,7 +341,7 @@ function validate_form() {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_announce_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('announce_date')
   </script>
 </div>
@@ -355,7 +355,7 @@ function validate_form() {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_cf_due_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('cf_due_date')
   </script>
 </div>
diff --git a/extensions/BMO/template/en/default/bug/create/create-swag.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-swag.html.tmpl
index 859d77194..28b8045f6 100644
--- a/extensions/BMO/template/en/default/bug/create/create-swag.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-swag.html.tmpl
@@ -810,7 +810,7 @@ function showGear() {
   We do this to help protect the personal identifying information in this [% terms.bugs %].
 </p>
 
-<script>
+<script [% script_nonce FILTER none %]>
   initFields();
   onPurposeChange();
   onAddGearChange();
diff --git a/extensions/BMO/template/en/default/bug/create/create-user-engagement.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-user-engagement.html.tmpl
index 7df624700..64af64a6b 100644
--- a/extensions/BMO/template/en/default/bug/create/create-user-engagement.html.tmpl
+++ b/extensions/BMO/template/en/default/bug/create/create-user-engagement.html.tmpl
@@ -166,7 +166,7 @@ function toggleGoalOther() {
     <span>Calendar</span>
   </button>
   <div id="con_calendar_timing_date"></div>
-  <script>
+  <script [% script_nonce FILTER none %]>
     createCalendar('timing_date')
   </script>
 </div>
diff --git a/extensions/BMO/template/en/default/hook/admin/products/edit-common-rows.html.tmpl b/extensions/BMO/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
index 5486684f1..632ccb1e6 100644
--- a/extensions/BMO/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
@@ -30,7 +30,7 @@
     <span id="security_group_warning" style="color:red; display:none;">
       This security group needs to be set to SHOWN/SHOWN
     </span>
-    <script>
+    <script [% script_nonce FILTER none %]>
       var toggleGroupWarning = function() {
         var correct_shown = $('#security_group_id option:selected').data('group-correct-visibility');
         if ($('#security_group_id').val() === '' || correct_shown) {
diff --git a/extensions/BMO/template/en/default/hook/attachment/edit-view.html.tmpl b/extensions/BMO/template/en/default/hook/attachment/edit-view.html.tmpl
index c66a02371..e28a142ae 100644
--- a/extensions/BMO/template/en/default/hook/attachment/edit-view.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/attachment/edit-view.html.tmpl
@@ -35,7 +35,7 @@
     [% attachment_data FILTER html %]
   </pre>
   [% IF user.id %]
-    <script>
+    <script [% script_nonce FILTER none %]>
     <!--
       var patchviewerinstalled = 0;
       document.write('<button type="button" id="editButton" onclick="editAsComment(patchviewerinstalled);">Edit Attachment As Comment<\/button>');
diff --git a/extensions/BMO/template/en/default/hook/bug/comments-a_comment-end.html.tmpl b/extensions/BMO/template/en/default/hook/bug/comments-a_comment-end.html.tmpl
index 3c47ca199..d6dec42b9 100644
--- a/extensions/BMO/template/en/default/hook/bug/comments-a_comment-end.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/bug/comments-a_comment-end.html.tmpl
@@ -10,7 +10,7 @@
       && (comment.author.login_name == 'tbplbot@gmail.com' || comment.author.login_name == 'orangefactor@bots.tld')
 %]
   [% has_tbpl_comment = 1 %]
-  <script>
+  <script [% script_nonce FILTER none %]>
     var id = [% count FILTER none %];
     tbpl_comment_ids.push(id);
     collapse_comment(
diff --git a/extensions/BMO/template/en/default/hook/bug/comments-aftercomments.html.tmpl b/extensions/BMO/template/en/default/hook/bug/comments-aftercomments.html.tmpl
index 65bf77967..aa76de122 100644
--- a/extensions/BMO/template/en/default/hook/bug/comments-aftercomments.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/bug/comments-aftercomments.html.tmpl
@@ -11,7 +11,7 @@
   [% collapse_caption = 'Collapse TinderboxPushlog Comments' %]
   [% show_caption     = 'Show TinderboxPushlog Comments' %]
   [% hide_caption     = 'Hide TinderboxPushlog Comments' %]
-  <script>
+  <script [% script_nonce FILTER none %]>
     YAHOO.util.Event.onDOMReady(function () {
         var ul = document.getElementsByClassName('bz_collapse_expand_comments');
         if (ul.length == 0)
diff --git a/extensions/BMO/template/en/default/hook/bug/comments-comment_banner.html.tmpl b/extensions/BMO/template/en/default/hook/bug/comments-comment_banner.html.tmpl
index 135e1cd95..f490ad826 100644
--- a/extensions/BMO/template/en/default/hook/bug/comments-comment_banner.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/bug/comments-comment_banner.html.tmpl
@@ -10,6 +10,6 @@
 
 [%# Needed for collapsing TinderboxPushlog comments %]
 [% has_tbpl_comment = 0 %]
-<script>
+<script [% script_nonce FILTER none %]>
   var tbpl_comment_ids = new Array();
 </script>
diff --git a/extensions/BMO/template/en/default/hook/bug/edit-after_importance.html.tmpl b/extensions/BMO/template/en/default/hook/bug/edit-after_importance.html.tmpl
index 6e15e50d3..1dec71b8d 100644
--- a/extensions/BMO/template/en/default/hook/bug/edit-after_importance.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/bug/edit-after_importance.html.tmpl
@@ -7,7 +7,7 @@
   #%]
 
 [%# Display product and component descriptions after their respective fields %]
-<script>
+<script [% script_nonce FILTER none %]>
   var Event = YAHOO.util.Event;
   var Dom = YAHOO.util.Dom;
   Event.onDOMReady(function() {
diff --git a/extensions/BMO/template/en/default/hook/bug/edit-custom_field.html.tmpl b/extensions/BMO/template/en/default/hook/bug/edit-custom_field.html.tmpl
index 31669f47f..87b51c924 100644
--- a/extensions/BMO/template/en/default/hook/bug/edit-custom_field.html.tmpl
+++ b/extensions/BMO/template/en/default/hook/bug/edit-custom_field.html.tmpl
@@ -45,7 +45,7 @@
             id = field.name name = field.name minrows = 4 maxrows = 8
             cols = 60 defaultcontent = value %]
       </div>
-      <script>
+      <script [% script_nonce FILTER none %]>
         hideEditableField('[% field.name FILTER js %]_edit_container',
                           '[% field.name FILTER js %]_input',
                           '[% field.name FILTER js %]_edit_action',
diff --git a/extensions/BMO/template/en/default/pages/attachment_bounty_form.html.tmpl b/extensions/BMO/template/en/default/pages/attachment_bounty_form.html.tmpl
index a538e9347..faf32aa36 100644
--- a/extensions/BMO/template/en/default/pages/attachment_bounty_form.html.tmpl
+++ b/extensions/BMO/template/en/default/pages/attachment_bounty_form.html.tmpl
@@ -162,7 +162,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_reported_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('reported_date')
     </script>
   </div>
@@ -177,7 +177,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_fixed_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('fixed_date')
     </script>
   </div>
@@ -192,7 +192,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_awarded_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('awarded_date')
     </script>
   </div>
diff --git a/extensions/BMO/template/en/default/pages/release_tracking_report.html.tmpl b/extensions/BMO/template/en/default/pages/release_tracking_report.html.tmpl
index 79587205c..8ee3d0d59 100644
--- a/extensions/BMO/template/en/default/pages/release_tracking_report.html.tmpl
+++ b/extensions/BMO/template/en/default/pages/release_tracking_report.html.tmpl
@@ -18,7 +18,7 @@
 <h1>JavaScript is required to use this report.</h1>
 </noscript>
 
-<script>
+<script [% script_nonce FILTER none %]>
 var flags_data = $.parseJSON("[% flags_json FILTER js %]");
 var products_data = $.parseJSON("[% products_json FILTER js %]");
 var fields_data = $.parseJSON("[% fields_json FILTER js %]");
diff --git a/extensions/BMO/template/en/default/pages/triage_reports.html.tmpl b/extensions/BMO/template/en/default/pages/triage_reports.html.tmpl
index 05efefca5..13904f61b 100644
--- a/extensions/BMO/template/en/default/pages/triage_reports.html.tmpl
+++ b/extensions/BMO/template/en/default/pages/triage_reports.html.tmpl
@@ -137,7 +137,7 @@ Show UNCONFIRMED [% terms.bugs %] with:
 </table>
 
 </form>
-<script>
+<script [% script_nonce FILTER none %]>
   createCalendar('last_is');
 </script>
 
diff --git a/extensions/BMO/template/en/default/pages/user_activity.html.tmpl b/extensions/BMO/template/en/default/pages/user_activity.html.tmpl
index 33aa27e3d..075c8edf9 100644
--- a/extensions/BMO/template/en/default/pages/user_activity.html.tmpl
+++ b/extensions/BMO/template/en/default/pages/user_activity.html.tmpl
@@ -83,7 +83,7 @@
 [% END %]
 </form>
 
-<script>
+<script [% script_nonce FILTER none %]>
   createCalendar('from');
   createCalendar('to');
 </script>
diff --git a/extensions/BugmailFilter/template/en/default/account/prefs/bugmail_filter.html.tmpl b/extensions/BugmailFilter/template/en/default/account/prefs/bugmail_filter.html.tmpl
index 32cb55ea1..bb1381c46 100644
--- a/extensions/BugmailFilter/template/en/default/account/prefs/bugmail_filter.html.tmpl
+++ b/extensions/BugmailFilter/template/en/default/account/prefs/bugmail_filter.html.tmpl
@@ -14,7 +14,7 @@
 [% SET selectable_products = user.get_selectable_products %]
 [% SET dont_show_button = 1 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 var useclassification = false;
 var first_load = true;
 var last_sel = [];
diff --git a/extensions/ComponentWatching/template/en/default/account/prefs/component_watch.html.tmpl b/extensions/ComponentWatching/template/en/default/account/prefs/component_watch.html.tmpl
index b70a46b35..2a2ab6bc5 100644
--- a/extensions/ComponentWatching/template/en/default/account/prefs/component_watch.html.tmpl
+++ b/extensions/ComponentWatching/template/en/default/account/prefs/component_watch.html.tmpl
@@ -23,7 +23,7 @@
 }
 </style>
 
-<script>
+<script [% script_nonce FILTER none %]>
 var Dom = YAHOO.util.Dom;
 var useclassification = false;
 var first_load = true;
@@ -47,7 +47,7 @@ var watch_users = new Array();
 <script src="[% 'js/productform.js' FILTER version FILTER html %]">
 </script>
 
-<script>
+<script [% script_nonce FILTER none %]>
 function onSelectProduct() {
   var component = Dom.get('component');
   selectProduct(Dom.get('product'), component);
diff --git a/extensions/ComponentWatching/template/en/default/hook/admin/components/edit-common-rows.html.tmpl b/extensions/ComponentWatching/template/en/default/hook/admin/components/edit-common-rows.html.tmpl
index e6a04f092..940fc2d11 100644
--- a/extensions/ComponentWatching/template/en/default/hook/admin/components/edit-common-rows.html.tmpl
+++ b/extensions/ComponentWatching/template/en/default/hook/admin/components/edit-common-rows.html.tmpl
@@ -27,7 +27,7 @@
   </td>
 </tr>
 
-<script>
+<script [% script_nonce FILTER none %]>
 function sanitise_name(name) {
   return name.toLowerCase()
              .replace(/[^a-z0-9_]/g, '-')
diff --git a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
index 98a8f4184..8d8b12505 100644
--- a/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
+++ b/extensions/EditTable/template/en/default/pages/edit_table.html.tmpl
@@ -35,7 +35,7 @@
 <input type="submit" value="Commit Changes" id="commit_btn" class="bz_default_hidden">
 </form>
 
-<script>
+<script [% script_nonce FILTER none %]>
   var table_data_str = "[% table_data FILTER js %]";
   var table_data = $.parseJSON(table_data_str);
   var editTable = new EditTable('edit_table', table_data);
diff --git a/extensions/FlagDefaultRequestee/template/en/default/flag/default_requestees.html.tmpl b/extensions/FlagDefaultRequestee/template/en/default/flag/default_requestees.html.tmpl
index 08f90b8d4..0cb5f2ff1 100644
--- a/extensions/FlagDefaultRequestee/template/en/default/flag/default_requestees.html.tmpl
+++ b/extensions/FlagDefaultRequestee/template/en/default/flag/default_requestees.html.tmpl
@@ -7,7 +7,7 @@
   #%]
 
 [% IF flag_default_requestees.keys.size %]
-  <script>
+  <script [% script_nonce FILTER none %]>
   var currently_requested = new Array();
   var default_requestees = new Array();
   [% FOREACH id = flag_currently_requested.keys %]
diff --git a/extensions/FlagTypeComment/template/en/default/flag/type_comment.html.tmpl b/extensions/FlagTypeComment/template/en/default/flag/type_comment.html.tmpl
index 7cadbdca5..88d9d4dd7 100644
--- a/extensions/FlagTypeComment/template/en/default/flag/type_comment.html.tmpl
+++ b/extensions/FlagTypeComment/template/en/default/flag/type_comment.html.tmpl
@@ -21,7 +21,7 @@
   #%]
 
 [% IF ftc_flags.keys.size %]
-  <script>
+  <script [% script_nonce FILTER none %]>
   YAHOO.util.Event.onDOMReady(function() {
     var selects = YAHOO.util.Dom.getElementsByClassName('flag_select');
     for (var i = 0; i < selects.length; i++) {
diff --git a/extensions/GuidedBugEntry/template/en/default/guided/guided.html.tmpl b/extensions/GuidedBugEntry/template/en/default/guided/guided.html.tmpl
index b9cfa6fbf..20192841f 100644
--- a/extensions/GuidedBugEntry/template/en/default/guided/guided.html.tmpl
+++ b/extensions/GuidedBugEntry/template/en/default/guided/guided.html.tmpl
@@ -32,7 +32,7 @@ Please use the <a href="enter_bug.cgi?format=__default__">advanced [% terms.bug
 <div id="loading" class="hidden">
 Please wait...
 </div>
-<script>
+<script [% script_nonce FILTER none %]>
 YAHOO.util.Dom.removeClass('loading', 'hidden');
 </script>
 
@@ -50,7 +50,7 @@ YAHOO.util.Dom.removeClass('loading', 'hidden');
   <a id="advanced_link" href="enter_bug.cgi?format=__default__">Switch to the advanced [% terms.bug %] entry form</a>
 </div>
 
-<script>
+<script [% script_nonce FILTER none %]>
 YAHOO.util.Dom.addClass('loading', 'hidden');
 guided.init({ webdev: [% webdev ? "true" : "false" %] });
 guided.currentUser = '[% user.login FILTER js %]';
diff --git a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
index c224a4e45..d0a3abb5b 100644
--- a/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
+++ b/extensions/InlineHistory/template/en/default/hook/bug/comments-aftercomments.html.tmpl
@@ -10,7 +10,7 @@
 [%# this div exists to allow bugzilla-tweaks to detect when we're active %]
 <div id="inline-history-ext"></div>
 
-<script>
+<script [% script_nonce FILTER none %]>
   var ih_activity = new Array();
   var ih_activity_flags = new Array();
   var ih_activity_sort_order = '[% user.settings.comment_sort_order.value FILTER js %]';
diff --git a/extensions/MyDashboard/template/en/default/pages/mydashboard.html.tmpl b/extensions/MyDashboard/template/en/default/pages/mydashboard.html.tmpl
index e07edbc83..7956fcfae 100644
--- a/extensions/MyDashboard/template/en/default/pages/mydashboard.html.tmpl
+++ b/extensions/MyDashboard/template/en/default/pages/mydashboard.html.tmpl
@@ -74,7 +74,7 @@
   </div>
 </script>
 
-<script>
+<script [% script_nonce FILTER none %]>
   [% IF Param('splinter_base') %]
     MyDashboard.splinter_base = '[% Bugzilla.splinter_review_base FILTER js %]';
   [% END %]
diff --git a/extensions/Needinfo/template/en/default/hook/attachment/edit-after_comment_textarea.html.tmpl b/extensions/Needinfo/template/en/default/hook/attachment/edit-after_comment_textarea.html.tmpl
index 22ee41af6..9ed394fbb 100644
--- a/extensions/Needinfo/template/en/default/hook/attachment/edit-after_comment_textarea.html.tmpl
+++ b/extensions/Needinfo/template/en/default/hook/attachment/edit-after_comment_textarea.html.tmpl
@@ -9,7 +9,7 @@
 [% PROCESS bug/needinfo.html.tmpl
    bug => attachment.bug
 %]
-<script>
+<script [% script_nonce FILTER none %]>
   document.getElementById('editButton').addEventListener('click', function() {
     document.getElementById('attachment_view_window')
       .appendChild(document.getElementById('needinfo_container'));
diff --git a/extensions/Push/template/en/default/pages/push_config.html.tmpl b/extensions/Push/template/en/default/pages/push_config.html.tmpl
index 3783ecad6..dd5507bbc 100644
--- a/extensions/Push/template/en/default/pages/push_config.html.tmpl
+++ b/extensions/Push/template/en/default/pages/push_config.html.tmpl
@@ -12,7 +12,7 @@
   style_urls = [ 'extensions/Push/web/admin.css' ]
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 var push_defaults = new Array();
 [% FOREACH option = push.config.options %]
   [% IF option.name != 'enabled' && option.default != '' %]
@@ -127,7 +127,7 @@ var push_defaults = new Array();
     </tr>
   [% END %]
   [% IF name != 'global' %]
-    <script>
+    <script [% script_nonce FILTER none %]>
       var is_enabled = document.getElementById('[% name FILTER js %]_enabled').value == 'Enabled';
       toggle_options(is_enabled, '[% name FILTER js %]');
     </script>
diff --git a/extensions/REMO/template/en/default/bug/create/create-remo-budget.html.tmpl b/extensions/REMO/template/en/default/bug/create/create-remo-budget.html.tmpl
index 62f45d568..5c19ac758 100644
--- a/extensions/REMO/template/en/default/bug/create/create-remo-budget.html.tmpl
+++ b/extensions/REMO/template/en/default/bug/create/create-remo-budget.html.tmpl
@@ -23,7 +23,7 @@
 any persons designated in the CC line, and authorized members of the Mozilla
 Rep team.</p>
 
-<script>
+<script [% script_nonce FILTER none %]>
 function trySubmit() {
   var firstname = document.getElementById('firstname').value;
   var lastname = document.getElementById('lastname').value;
@@ -135,7 +135,7 @@ function validateAndSubmit() {
       <span>Calendar</span>
     </button>
     <div id="con_calendar_cf_due_date"></div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       createCalendar('cf_due_date')
     </script>
   </td>
diff --git a/extensions/REMO/template/en/default/bug/create/create-remo-it.html.tmpl b/extensions/REMO/template/en/default/bug/create/create-remo-it.html.tmpl
index 10f65de39..af3db60bc 100644
--- a/extensions/REMO/template/en/default/bug/create/create-remo-it.html.tmpl
+++ b/extensions/REMO/template/en/default/bug/create/create-remo-it.html.tmpl
@@ -17,7 +17,7 @@
 [% USE Bugzilla %]
 [% mandatory = '<span class="mandatory" title="Required">*</span>' %]
 
-<script>
+<script [% script_nonce FILTER none %]>
 var Dom = YAHOO.util.Dom;
 
 function mandatory(elements) {
diff --git a/extensions/REMO/template/en/default/bug/create/create-remo-swag.html.tmpl b/extensions/REMO/template/en/default/bug/create/create-remo-swag.html.tmpl
index bc7c0d146..18b5a6c38 100644
--- a/extensions/REMO/template/en/default/bug/create/create-remo-swag.html.tmpl
+++ b/extensions/REMO/template/en/default/bug/create/create-remo-swag.html.tmpl
@@ -27,7 +27,7 @@
 <p>These requests will only be visible to the person who submitted the request,
 any persons designated in the CC line, and authorized members of the Mozilla Rep team.</p>
 
-<script>
+<script [% script_nonce FILTER none %]>
 function trySubmit() {
   var eventname = document.getElementById('eventname').value;
   var shortdesc = 'Swag Request - ' + eventname;
diff --git a/extensions/REMO/template/en/default/pages/remo-form-payment.html.tmpl b/extensions/REMO/template/en/default/pages/remo-form-payment.html.tmpl
index 4b4f237c2..1e1889089 100644
--- a/extensions/REMO/template/en/default/pages/remo-form-payment.html.tmpl
+++ b/extensions/REMO/template/en/default/pages/remo-form-payment.html.tmpl
@@ -30,7 +30,7 @@
                        'js/field.js' ]
 %]
 
-<script></script>
+<script [% script_nonce FILTER none %]></script>
 
 <h1>Mozilla Reps - Payment Form</h1>
 
diff --git a/extensions/Review/template/en/default/hook/attachment/create-end.html.tmpl b/extensions/Review/template/en/default/hook/attachment/create-end.html.tmpl
index 22d95d694..ed5ae7b36 100644
--- a/extensions/Review/template/en/default/hook/attachment/create-end.html.tmpl
+++ b/extensions/Review/template/en/default/hook/attachment/create-end.html.tmpl
@@ -10,7 +10,7 @@
   [% bug = attachment.bug %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   $(function() {
     [% IF bug.product_obj.reviewer_required %]
       REVIEW.init_mandatory();
diff --git a/extensions/Review/template/en/default/hook/attachment/edit-end.html.tmpl b/extensions/Review/template/en/default/hook/attachment/edit-end.html.tmpl
index be866ae4b..5e7629eac 100644
--- a/extensions/Review/template/en/default/hook/attachment/edit-end.html.tmpl
+++ b/extensions/Review/template/en/default/hook/attachment/edit-end.html.tmpl
@@ -7,7 +7,7 @@
   #%]
 
 [% IF attachment.bug.product_obj.reviewer_required %]
-<script>
+<script [% script_nonce FILTER none %]>
 $(function() {
   REVIEW.init_mandatory();
 });
diff --git a/extensions/Review/template/en/default/hook/bug/create/create-end.html.tmpl b/extensions/Review/template/en/default/hook/bug/create/create-end.html.tmpl
index c2c574bd9..04ec1b13b 100644
--- a/extensions/Review/template/en/default/hook/bug/create/create-end.html.tmpl
+++ b/extensions/Review/template/en/default/hook/bug/create/create-end.html.tmpl
@@ -6,7 +6,7 @@
   # defined by the Mozilla Public License, v. 2.0.
   #%]
 
-<script>
+<script [% script_nonce FILTER none %]>
   $(function() {
     [% IF product.reviewer_required %]
       REVIEW.init_mandatory();
diff --git a/extensions/Review/template/en/default/hook/bug/edit-after_people.html.tmpl b/extensions/Review/template/en/default/hook/bug/edit-after_people.html.tmpl
index b2f375b88..2392f5f6a 100644
--- a/extensions/Review/template/en/default/hook/bug/edit-after_people.html.tmpl
+++ b/extensions/Review/template/en/default/hook/bug/edit-after_people.html.tmpl
@@ -36,7 +36,7 @@
          %]
         <br>
       </div>
-      <script>
+      <script [% script_nonce FILTER none %]>
         hideEditableField('bz_bug_mentors_edit_container',
                           'bz_bug_mentors_input',
                           'bz_bug_mentors_edit_action',
diff --git a/extensions/Review/template/en/default/hook/flag/list-requestee.html.tmpl b/extensions/Review/template/en/default/hook/flag/list-requestee.html.tmpl
index 2c06f4950..771bc803c 100644
--- a/extensions/Review/template/en/default/hook/flag/list-requestee.html.tmpl
+++ b/extensions/Review/template/en/default/hook/flag/list-requestee.html.tmpl
@@ -12,6 +12,6 @@
   &nbsp;&nbsp;<a href="#" id="[% fid FILTER none %]_suggestions_link">suggested reviewers &#9662;</a>
 </span>
 
-<script>
+<script [% script_nonce FILTER none %]>
   REVIEW.init_review_flag('[% fid FILTER none %]', '[% flag_name FILTER none %]');
 </script>
diff --git a/extensions/Review/template/en/default/pages/review_history.html.tmpl b/extensions/Review/template/en/default/pages/review_history.html.tmpl
index d80ed5e0a..c8263bc52 100644
--- a/extensions/Review/template/en/default/pages/review_history.html.tmpl
+++ b/extensions/Review/template/en/default/pages/review_history.html.tmpl
@@ -19,7 +19,7 @@
             'js/field.js' ]
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   $(function () {
     YUI({
       base: 'js/yui3/',
diff --git a/extensions/SecureMail/template/en/default/hook/admin/users/userdata-end.html.tmpl b/extensions/SecureMail/template/en/default/hook/admin/users/userdata-end.html.tmpl
index 1b65e71a8..a90266dae 100644
--- a/extensions/SecureMail/template/en/default/hook/admin/users/userdata-end.html.tmpl
+++ b/extensions/SecureMail/template/en/default/hook/admin/users/userdata-end.html.tmpl
@@ -31,7 +31,7 @@
   </td>
 </tr>
 
-<script>
+<script [% script_nonce FILTER none %]>
 $(function() {
     'use strict';
     var securemail_groups = [];
diff --git a/extensions/Splinter/template/en/default/pages/splinter.html.tmpl b/extensions/Splinter/template/en/default/pages/splinter.html.tmpl
index 9e59f1520..b5cab5c59 100644
--- a/extensions/Splinter/template/en/default/pages/splinter.html.tmpl
+++ b/extensions/Splinter/template/en/default/pages/splinter.html.tmpl
@@ -37,7 +37,7 @@
 
 [% can_edit = 0 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   Splinter.configBase = '[% Bugzilla.splinter_review_base FILTER js %]';
   Splinter.configBugUrl = '[% urlbase FILTER js %]';
   Splinter.configHaveExtension = true;
@@ -229,7 +229,7 @@
                                              any_flags_requesteeble = any_flags_requesteeble
             %]
           [% END %]
-          <script>
+          <script [% script_nonce FILTER none %]>
             [% FOREACH flag_type = flag_types %]
               [% NEXT UNLESS flag_type.is_active %]
               Event.addListener('flag_type-[% flag_type.id FILTER js %]', 'change',
diff --git a/extensions/TrackingFlags/template/en/default/bug/tracking_flags.html.tmpl b/extensions/TrackingFlags/template/en/default/bug/tracking_flags.html.tmpl
index 962271254..3fbb622de 100644
--- a/extensions/TrackingFlags/template/en/default/bug/tracking_flags.html.tmpl
+++ b/extensions/TrackingFlags/template/en/default/bug/tracking_flags.html.tmpl
@@ -32,7 +32,7 @@
               [% value.name FILTER html %]</option>
           [% END %]
         </select>
-        <script>
+        <script [% script_nonce FILTER none %]>
           initHidingOptionsForIE('[% flag.name FILTER js %]');
         </script>
         [% IF !new_bug && user.id %]
@@ -47,7 +47,7 @@
   </tr>
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   var tracking_flags_str = "[% tracking_flags_json FILTER js %]";
   TrackingFlags = $.parseJSON(tracking_flags_str);
 </script>
diff --git a/extensions/TrackingFlags/template/en/default/hook/bug/create/create-form.html.tmpl b/extensions/TrackingFlags/template/en/default/hook/bug/create/create-form.html.tmpl
index 4bb9e1eab..005cc8062 100644
--- a/extensions/TrackingFlags/template/en/default/hook/bug/create/create-form.html.tmpl
+++ b/extensions/TrackingFlags/template/en/default/hook/bug/create/create-form.html.tmpl
@@ -28,7 +28,7 @@
   END;
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   $(function() {
     var tracking_flag_components_str = "[% tracking_flag_components FILTER js %]";
     var tracking_flag_components = $.parseJSON(tracking_flag_components_str);
diff --git a/extensions/TrackingFlags/template/en/default/hook/bug/edit-after_custom_fields.html.tmpl b/extensions/TrackingFlags/template/en/default/hook/bug/edit-after_custom_fields.html.tmpl
index 1571fc4f9..1fccf6949 100644
--- a/extensions/TrackingFlags/template/en/default/hook/bug/edit-after_custom_fields.html.tmpl
+++ b/extensions/TrackingFlags/template/en/default/hook/bug/edit-after_custom_fields.html.tmpl
@@ -40,7 +40,7 @@
   [% END %]
 [% END %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   var tracking_flags_str = "[% tracking_flags_json FILTER js %]";
   var TrackingFlags = $.parseJSON(tracking_flags_str);
   hide_tracking_flags();
diff --git a/extensions/TrackingFlags/template/en/default/hook/bug/field-editable.html.tmpl b/extensions/TrackingFlags/template/en/default/hook/bug/field-editable.html.tmpl
index fb09b0ac1..91f89ea73 100644
--- a/extensions/TrackingFlags/template/en/default/hook/bug/field-editable.html.tmpl
+++ b/extensions/TrackingFlags/template/en/default/hook/bug/field-editable.html.tmpl
@@ -29,7 +29,7 @@
     </option>
   [% END %]
 </select>
-<script>
+<script [% script_nonce FILTER none %]>
 <!--
   initHidingOptionsForIE('[% field.name FILTER js %]');
   [%+ INCLUDE "bug/field-events.js.tmpl"
diff --git a/extensions/TrackingFlags/template/en/default/pages/tracking_flags_admin_edit.html.tmpl b/extensions/TrackingFlags/template/en/default/pages/tracking_flags_admin_edit.html.tmpl
index e381c4f1c..e1263a308 100644
--- a/extensions/TrackingFlags/template/en/default/pages/tracking_flags_admin_edit.html.tmpl
+++ b/extensions/TrackingFlags/template/en/default/pages/tracking_flags_admin_edit.html.tmpl
@@ -29,7 +29,7 @@ var selected_components = [
   style_urls = [ 'extensions/TrackingFlags/web/styles/admin.css' ]
 %]
 
-<script>
+<script [% script_nonce FILTER none %]>
   var groups_str = "[% groups || '[]' FILTER js %]";
   var groups = $.parseJSON(groups_str);
   var flag_values_str = "[% values || '[]' FILTER js %]";
diff --git a/extensions/UserStory/template/en/default/hook/bug/comments-comment_banner.html.tmpl b/extensions/UserStory/template/en/default/hook/bug/comments-comment_banner.html.tmpl
index c6a16f7d0..e063ac942 100644
--- a/extensions/UserStory/template/en/default/hook/bug/comments-comment_banner.html.tmpl
+++ b/extensions/UserStory/template/en/default/hook/bug/comments-comment_banner.html.tmpl
@@ -11,7 +11,7 @@
 [% can_edit_story = bug.check_can_change_field('cf_user_story', 0, 1) %]
 
 <div class="user_story">
-  <script>
+  <script [% script_nonce FILTER none %]>
     function userStoryComment() {
         var commenttext = "(Commenting on User Story)\n";
         var text_elem = document.getElementById('user_story');
@@ -61,7 +61,7 @@
                 cols    = constants.COMMENT_COLS
                 defaultcontent = bug.cf_user_story %]
     </div>
-    <script>
+    <script [% script_nonce FILTER none %]>
       YAHOO.util.Event.addListener('user_story_edit_action', 'click', function() {
         YAHOO.util.Dom.addClass('user_story_edit', 'bz_default_hidden');
         YAHOO.util.Dom.addClass('user_story_readonly', 'bz_default_hidden');
diff --git a/extensions/UserStory/template/en/default/hook/bug/create/create-after_custom_fields.html.tmpl b/extensions/UserStory/template/en/default/hook/bug/create/create-after_custom_fields.html.tmpl
index 77734408a..6079ec616 100644
--- a/extensions/UserStory/template/en/default/hook/bug/create/create-after_custom_fields.html.tmpl
+++ b/extensions/UserStory/template/en/default/hook/bug/create/create-after_custom_fields.html.tmpl
@@ -32,7 +32,7 @@
             defaultcontent = user_story_default
         %]
       </div>
-      <script>
+      <script [% script_nonce FILTER none %]>
         var user_story_exclude_components = [];
         [% FOREACH c = default.user_story_visible.1 %]
           user_story_exclude_components.push('[% c FILTER js %]');
diff --git a/extensions/Voting/template/en/default/hook/admin/products/edit-common-rows.html.tmpl b/extensions/Voting/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
index e5a29ba56..fde6434de 100644
--- a/extensions/Voting/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
+++ b/extensions/Voting/template/en/default/hook/admin/products/edit-common-rows.html.tmpl
@@ -50,7 +50,7 @@
            value="[% product.votestoconfirm FILTER html %]">
     <br>(Setting this to 0 disables auto-confirming [% terms.bugs %]
     by vote.)
-    <script>
+    <script [% script_nonce FILTER none %]>
         YAHOO.util.Event.addListener('allows_unconfirmed', 'change',
             function() { bz_toggleClass('votes_to_confirm_container',
                                         'bz_default_hidden'); });
-- 
cgit v1.2.3-24-g4f1b