From 8af1b99639d13061c69e17de8ae6a0f3742e916e Mon Sep 17 00:00:00 2001
From: Adam Rauch <adam@labkey.com>
Date: Thu, 15 Feb 2024 17:18:01 -0800
Subject: [PATCH 1/2] Add nonces to script tags

---
 .../resources/assay/example/views/upload.html    |  2 +-
 .../resources/views/Lab Results.html             |  2 +-
 .../resources/views/Physical Exam.html           |  2 +-
 reactExamples/resources/views/demoWebpart.html   |  2 +-
 sourdough/resources/views/login.html             | 16 +++++++++-------
 sourdough/resources/views/styling.html           |  2 +-
 6 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/exampleassay/resources/assay/example/views/upload.html b/exampleassay/resources/assay/example/views/upload.html
index 67b9205..1de4ac1 100644
--- a/exampleassay/resources/assay/example/views/upload.html
+++ b/exampleassay/resources/assay/example/views/upload.html
@@ -38,7 +38,7 @@
     </a>
 </p>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 function done()
 {
diff --git a/interactiveTutorial/resources/views/Lab Results.html b/interactiveTutorial/resources/views/Lab Results.html
index 5f499cd..9a64f74 100644
--- a/interactiveTutorial/resources/views/Lab Results.html	
+++ b/interactiveTutorial/resources/views/Lab Results.html	
@@ -1,5 +1,5 @@
 <div id='divLabResults'/>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 // Ensure that page dependencies are loaded
 LABKEY.requiresExt3ClientAPI(function() {
diff --git a/interactiveTutorial/resources/views/Physical Exam.html b/interactiveTutorial/resources/views/Physical Exam.html
index e64ce13..7fad091 100644
--- a/interactiveTutorial/resources/views/Physical Exam.html	
+++ b/interactiveTutorial/resources/views/Physical Exam.html	
@@ -1,5 +1,5 @@
 <div id='divPhysicalExam'/>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
 // Ensure that page dependencies are loaded
 LABKEY.requiresExt3ClientAPI(function() {
diff --git a/reactExamples/resources/views/demoWebpart.html b/reactExamples/resources/views/demoWebpart.html
index ee33474..f503312 100644
--- a/reactExamples/resources/views/demoWebpart.html
+++ b/reactExamples/resources/views/demoWebpart.html
@@ -1,4 +1,4 @@
-<script type="application/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     +function() {
         LABKEY.App.loadApp('demoWebpart', <%=webpartContext%>.wrapperDivId);
     }();
diff --git a/sourdough/resources/views/login.html b/sourdough/resources/views/login.html
index 4b5f062..a2488a8 100644
--- a/sourdough/resources/views/login.html
+++ b/sourdough/resources/views/login.html
@@ -6,7 +6,7 @@
         <input id="email" name="email" type="text" class="input-block" tabindex="1" autocomplete="off">
         <label for="password">Password</label>
         <div class="forgot-password-link">
-            <a href="login-resetPassword.view?">Forgot password</a>
+            <a href="login-resetPassword.view">Forgot password</a>
         </div>
         <input id="password" name="password" type="password" class="input-block" tabindex="2" autocomplete="off">
         <input tabindex="3" type="checkbox" name="remember" id="remember"  checked> Remember my email address
@@ -14,7 +14,7 @@
             <div class="auth-header auth-item">Terms of Use</div>
             <div class="toucontent auth-item termsOfUseContent"></div>
             <div class="auth-item">
-                <input type="checkbox" tabindex="4" name="approvedTermsOfUse" id="approvedTermsOfUse" class="auth-item" unchecked>
+                <input type="checkbox" tabindex="4" name="approvedTermsOfUse" id="approvedTermsOfUse" class="auth-item">
                 <label for="approvedTermsOfUse">I agree to these terms</label>
             </div>
         </div>
@@ -23,7 +23,7 @@
             <input type="submit" tabindex="-1" class="loginSubmitButton"/>
             <a tabindex="5" class="labkey-button primary signin-btn"><span>Sign In</span></a>
             <span class="registrationSection" hidden>
-                <a class="labkey-button" id="registerButton" href="login-register.view?">Register</a>
+                <a class="labkey-button" id="registerButton" href="login-register.view">Register</a>
             </span>
         </div>
         <div class="signing-in-msg" hidden>
@@ -36,8 +36,10 @@
     </div>
 </form>
 
-<script type="application/javascript" nonce="<%= scriptNonce %>">
-    if (LABKEY.ActionURL.getParameter('returnUrl')) {
-        document.getElementById('registerButton').href += 'returnUrl=' + encodeURIComponent(LABKEY.ActionURL.getParameter('returnUrl'));
-    }
+<script type="text/javascript" nonce="<%=scriptNonce%>">
+    LABKEY.Utils.onReady(function() {
+        if (LABKEY.ActionURL.getParameter('returnUrl')) {
+            document.getElementById('registerButton').href += '?returnUrl=' + encodeURIComponent(LABKEY.ActionURL.getParameter('returnUrl'));
+        }
+    });
 </script>
diff --git a/sourdough/resources/views/styling.html b/sourdough/resources/views/styling.html
index d60f5f9..88dbdc1 100644
--- a/sourdough/resources/views/styling.html
+++ b/sourdough/resources/views/styling.html
@@ -8,7 +8,7 @@
         <img class="loaf" src="https://media.tenor.com/TTTGbs0vtOEAAAAi/bread-spin.gif"  alt="bouncing bread"/>
 
         <div>
-            Click <a href="<%=contextPath%>/project<%=containerPath%>/sourdough-styling.view"> here </a> to see this panel as a full page!
+            Click <a href="<%=contextPath%><%=containerPath%>/sourdough-styling.view"> here </a> to see this panel as a full page!
         </div>
     </div>
 

From f7c1517bd30b8e501ceb9190a2b327e3b4dffdbb Mon Sep 17 00:00:00 2001
From: Adam Rauch <adam@labkey.com>
Date: Sun, 18 Feb 2024 11:40:46 -0800
Subject: [PATCH 2/2] Add another nonce

---
 sourdough/resources/views/_header.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sourdough/resources/views/_header.html b/sourdough/resources/views/_header.html
index 42c9d8c..9e2eb7f 100644
--- a/sourdough/resources/views/_header.html
+++ b/sourdough/resources/views/_header.html
@@ -1,4 +1,4 @@
-<script>
+<script type="text/javascript" nonce="<%=scriptNonce%>">
     const elems = document.querySelectorAll("div[id^='ModuleHtmlView']");
     elems[0].style.display = "inline";
 </script>