https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #1 from David Cook <dcook@prosentient.com.au> --- egrep -R " on[a-zA-Z]+=" --exclude-dir="greybox" koha-tmpl/intranet-tmpl/ | wc -l The above shows that there are currently 181 instances of inline event handler attributes in the staff interface templates (Note: There may be other places where inline event handler attributes are added to generated code throughout Koha other than in templates, but I think that Koha/FrameworkPlugin.pm already looks fixed, so those places might be few or non-existent.) -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=38364 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 David Cook <dcook@prosentient.com.au> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CONFIRMED --- Comment #2 from David Cook <dcook@prosentient.com.au> --- It wouldn't hurt to have a test in the QA scripts to make sure that inline event handler attributes aren't being added, if we don't have one already. Note that we can quote the coding guidelines when we do specific reports for this one: https://wiki.koha-community.org/wiki/Coding_Guidelines#JS9:_Avoid_the_use_of... -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #3 from David Cook <dcook@prosentient.com.au> --- On bug 38365, Jonathan has pointed out a few places to check in the cataloguing editor like cloning subfields and using the Tag Editor for fields with linked authorities like 100$a -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #4 from David Cook <dcook@prosentient.com.au> --- Technically, this is just a best practice in general and even a Koha coding guidelines requirement. Even without Content-Security-Policy. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 Jonathan Druart <jonathan.druart@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |38365 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38365 [Bug 38365] Add Content-Security-Policy HTTP header to HTML responses -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #7 from David Cook <dcook@prosentient.com.au> --- But now that bug 38365 is pushed, I'll have more resources free to work on this one. Yay! -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #9 from David Cook <dcook@prosentient.com.au> --- (In reply to Jonathan Druart from comment #8)

(In reply to David Cook from comment #6)

...

Technically, we don't have to have this one depend on bug 38365. That is, the change for bug 38407 don't require bug 38365.

Yes but I wanted to highlight that this one was the next step. Feel free to remove it if you disagree.

Fair enough! I think I'm happy to leave it for now. Especially as I was thinking of spinning off other reports that this one will depend on anyway. Yeah it's fine. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |42438 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42438 [Bug 42438] Remove event attributes from icon selection include file -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |42440 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42440 [Bug 42440] Remove event attributes from labeled MARC detail template -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |42442 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42442 [Bug 42442] Remove event attributes from bibliographic record merge template -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #10 from David Cook <dcook@prosentient.com.au> --- You're a legend, Owen. Hoping to take a look a those dep bugs soon. -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 --- Comment #12 from David Cook <dcook@prosentient.com.au> --- (In reply to Owen Leonard from comment #11)

(In reply to David Cook from comment #10)

...

You're a legend, Owen. Hoping to take a look a those dep bugs soon.

I'm just picking the low-hanging fruit :D Scared to touch addbiblio.tt and additems.tt! XD

I figure the harder ones are easier because they're more likely to explode 😅 -- You are receiving this mail because: You are watching all bug changes.

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38407 Sally <sally.healey@cheshiresharedservices.gov.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sally.healey@cheshireshared | |services.gov.uk -- You are receiving this mail because: You are watching all bug changes.