Index: openacs-4/packages/acs-templating/acs-templating.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/acs-templating.info,v
diff -u -r1.66.2.3 -r1.66.2.4
--- openacs-4/packages/acs-templating/acs-templating.info	25 Apr 2019 15:49:19 -0000	1.66.2.3
+++ openacs-4/packages/acs-templating/acs-templating.info	28 Feb 2020 13:59:24 -0000	1.66.2.4
@@ -9,7 +9,7 @@
     <implements-subsite-p>f</implements-subsite-p>
     <inherit-templates-p>t</inherit-templates-p>
 
-    <version name="5.10.0d10" url="http://openacs.org/repository/download/apm/acs-templating-5.10.0d10.apm">
+    <version name="5.10.0d11" url="http://openacs.org/repository/download/apm/acs-templating-5.10.0d11.apm">
         <owner url="http://openacs.org">OpenACS</owner>
         <summary>Templating library.</summary>
         <release-date>2019-01-23</release-date>
@@ -27,7 +27,7 @@
         <license>GPL version 2</license>
         <maturity>3</maturity>
 
-        <provides url="acs-templating" version="5.10.0d10"/>
+        <provides url="acs-templating" version="5.10.0d11"/>
         <requires url="acs-kernel" version="5.9.1"/>
         <requires url="acs-tcl" version="5.10.0d8"/>
 
Index: openacs-4/packages/acs-templating/tcl/head-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-templating/tcl/head-procs.tcl,v
diff -u -r1.45.2.15 -r1.45.2.16
--- openacs-4/packages/acs-templating/tcl/head-procs.tcl	6 Feb 2020 18:17:43 -0000	1.45.2.15
+++ openacs-4/packages/acs-templating/tcl/head-procs.tcl	28 Feb 2020 13:59:24 -0000	1.45.2.16
@@ -32,6 +32,7 @@
 ad_proc -public template::register_urn {
     -urn:required
     -resource:required
+    {-csp_list ""}
 } {
 
     Register a URN for a resource. These URNs provide a single place
@@ -48,16 +49,18 @@
     if {[info exists $key]} {
         set old_resource [set $key]
         #
-        # Prefer local URNs over non-local ones
+        # Prefer local URLs over non-local ones (starting with http*:)
         #
         if {[string match //* $old_resource] || [string match http* $old_resource]} {
             ns_log notice "overwrite URN: $urn <$old_resource> with <$resource>"
             set $key $resource
+            set ::template::head::urn_csp($urn) $csp_list
         } else {
             ns_log notice "keep old URN: $urn <$old_resource> instead of <$resource>"
         }
     } else {
         set $key $resource
+        set ::template::head::urn_csp($urn) $csp_list
         ns_log notice "add URN: $urn <$resource>"
     }
 }
@@ -162,6 +165,7 @@
     #
     set key ::template::head::urn($src)
     if {[info exists $key]} {
+        template::head::require_csp $::template::head::urn_csp($src)
         set src [set $key]
     } elseif {[string match urn:* $src]} {
         ns_log error "URN <$src> could not be resolved"
@@ -634,6 +638,7 @@
         #
         set key ::template::head::urn($src)
         if {[info exists $key]} {
+            template::head::require_csp $::template::head::urn_csp($src)
             set src [set $key]
         } elseif {[string match urn:* $src]} {
             ns_log error "URN <$src> could not be resolved"
@@ -742,6 +747,7 @@
 } {
     set key ::template::head::urn($resource)
     if {[info exists $key]} {
+        template::head::require_csp $::template::head::urn_csp($resource)
         set resource [set $key]
     }
     return $resource
@@ -755,7 +761,17 @@
     return [info exists ::template::head::urn($resource)]
 }
 
+ad_proc -private template::head::require_csp {
+    csp_list
+} {
+    Require the CSP directives as defined for URNs.
 
+    @param csp_list flat list of pairs consisting of directives and values.
+} {
+    foreach {directive value} $csp_list {
+        security::csp::require $directive $value
+    }
+}
 
 ad_proc template::head::prepare_multirows {} {
     Generate multirows for meta, css, scripts