From 20fc7cd69a71262c62f83c15e3692d492c7f3159 Mon Sep 17 00:00:00 2001
From: vincent porte <vincent@neuralia.co>
Date: Mon, 12 Jun 2023 14:43:20 +0200
Subject: [PATCH] setup nonce value in template containing scripts

---
 .../forum_conversation/partials/topic_detail_actions.html     | 2 +-
 .../templates/forum_conversation/partials/topic_likes.html    | 2 +-
 lacommunaute/templates/layouts/base.html                      | 4 ++--
 lacommunaute/templates/pages/home.html                        | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lacommunaute/templates/forum_conversation/partials/topic_detail_actions.html b/lacommunaute/templates/forum_conversation/partials/topic_detail_actions.html
index 2a93a14f2..8aa21b797 100644
--- a/lacommunaute/templates/forum_conversation/partials/topic_detail_actions.html
+++ b/lacommunaute/templates/forum_conversation/partials/topic_detail_actions.html
@@ -66,7 +66,7 @@
 {% endif %}
 
 
-<script>
+<script nonce="{{ request.csp_nonce }}">
     function DisabledMe(id) {
         document.getElementById(id).classList.add('disabled');
     }
diff --git a/lacommunaute/templates/forum_conversation/partials/topic_likes.html b/lacommunaute/templates/forum_conversation/partials/topic_likes.html
index 17c8d4ade..1da051056 100644
--- a/lacommunaute/templates/forum_conversation/partials/topic_likes.html
+++ b/lacommunaute/templates/forum_conversation/partials/topic_likes.html
@@ -25,6 +25,6 @@
     {% endwith %}
 </div>
 
-<script>
+<script nonce="{{ request.csp_nonce }}">
     document.activeElement?.blur();
 </script>
diff --git a/lacommunaute/templates/layouts/base.html b/lacommunaute/templates/layouts/base.html
index da1623e1f..f870e74ad 100644
--- a/lacommunaute/templates/layouts/base.html
+++ b/lacommunaute/templates/layouts/base.html
@@ -105,7 +105,7 @@
         {% block js %}
             {% import_static_JS_theme_inclusion %}
             <script src="{% static 'machina/build/js/machina.min.js' %}" type="text/javascript" charset="utf-8"></script>
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="{{ request.csp_nonce }}">
                 $(function() {
                     machina.init();
                     {% block onbodyload %}{% endblock onbodyload %}
@@ -115,7 +115,7 @@
 
         {% block extra_js %}
             <script src="{% static "vendor/tarteaucitron.js-1.11.0/tarteaucitron.js" %}"></script>
-            <script>
+            <script nonce="{{ request.csp_nonce }}">
                 // Tarteaucitron's language is set according to the browser configuration
                 // but a lot of users don't know how to change it.
                 // This can be forced only by using a global `var` statement.
diff --git a/lacommunaute/templates/pages/home.html b/lacommunaute/templates/pages/home.html
index a9a754d43..7d2db69a3 100644
--- a/lacommunaute/templates/pages/home.html
+++ b/lacommunaute/templates/pages/home.html
@@ -186,7 +186,7 @@ <h2 class="h1 mb-3 mb-lg-5">Améliorez votre pratique professionnelle :</h2>
 {% block extra_js %}
     {{ block.super }}
     <script async src="https://tally.so/widgets/embed.js"></script>
-    <script defer>
+    <script defer nonce="{{ request.csp_nonce }}">
         // Any given Tally popup will not be shown more than once every `minDaysBetweenDisplays` days.
         const minDaysBetweenDisplays = 14;
         const delayBeforeShowingPopupInSeconds = 45;