Index: openacs-4/packages/acs-bootstrap-installer/acs-bootstrap-installer.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-bootstrap-installer/acs-bootstrap-installer.info,v
diff -u -r1.39.2.13 -r1.39.2.14
--- openacs-4/packages/acs-bootstrap-installer/acs-bootstrap-installer.info	5 Sep 2016 11:34:40 -0000	1.39.2.13
+++ openacs-4/packages/acs-bootstrap-installer/acs-bootstrap-installer.info	6 Sep 2016 17:33:55 -0000	1.39.2.14
@@ -9,7 +9,7 @@
     <implements-subsite-p>f</implements-subsite-p>
     <inherit-templates-p>t</inherit-templates-p>
     
-   <version name="5.9.1d3" url="http://openacs.org/repository/download/apm/acs-bootstrap-installer-5.9.1d3.apm">
+   <version name="5.9.1d4" url="http://openacs.org/repository/download/apm/acs-bootstrap-installer-5.9.1d4.apm">
         <owner url="mailto:dhogaza@pacifier.com">Don Baccus</owner>
         <summary>Bootstraps an OpenACS installation.</summary>
         <release-date>2015-10-04</release-date>
@@ -18,7 +18,7 @@
         <license>GPL</license>
         <maturity>3</maturity>
 
-        <provides url="acs-bootstrap-installer" version="5.9.1d3"/>
+        <provides url="acs-bootstrap-installer" version="5.9.1d4"/>
         <requires url="acs-kernel" version="5.9.0"/>
         <requires url="acs-templating" version="5.9.0"/>
 
Index: openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.adp,v
diff -u -r1.2.2.1 -r1.2.2.2
--- openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.adp	5 Sep 2016 11:34:40 -0000	1.2.2.1
+++ openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.adp	6 Sep 2016 17:33:55 -0000	1.2.2.2
@@ -8,7 +8,7 @@
 <multiple name="link">    <link rel="@link.rel;literal@" href="@link.href@"<if @link.lang@ not nil and @link.lang;literal@ ne @doc.lang;literal@> lang="@link.lang;literal@"</if><if @link.title@ not nil> title="@link.title@"</if><if @link.type@ not nil> type="@link.type;literal@"</if><if @link.media@ not nil> media="@link.media;literal@"</if><if @link.integrity@ not nil> integrity="@link.integrity;literal@"</if><if @link.crossorigin@ not nil> crossorigin="@link.crossorigin;literal@"</if>>
 </multiple>
 
-<multiple name="___style"> <style type="@___style.type;literal@" <if @___style.lang@ not nil and @___style.lang;literal@ ne @doc.lang;literal@> lang="@___style.lang;literal@"</if><if @___style.title@ not nil> title="@___style.title@"</if><if @___style.media@ not nil> media="@___style.media;literal@"</if>>@___style.style;literal@
+<multiple name="___style"> <style type="@___style.type;literal@" <if @___style.lang@ not nil and @___style.lang;literal@ ne @doc.lang;literal@> lang="@___style.lang;literal@"</if><if @___style.title@ not nil> title="@___style.title@"</if><if @___style.media@ not nil> media="@___style.media;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>>@___style.style;literal@
 </style>
 </multiple>
 
@@ -23,7 +23,7 @@
 </script>
 </if>
 
-<multiple name="headscript">   <script type="@headscript.type;literal@"<if @headscript.src@ not nil> src="@headscript.src;literal@"</if><if @headscript.charset@ not nil> charset="@headscript.charset;literal@"</if><if @headscript.defer@ not nil> defer="@headscript.defer;literal@"</if><if @headscript.async@ not nil> async="@headscript.async;literal@"</if><if @headscript.integrity@ not nil> integrity="@headscript.integrity;literal@"</if><if @headscript.crossorigin@ not nil> crossorigin="@headscript.crossorigin;literal@"</if>><if @headscript.content@ not nil>@headscript.content;noquote@</if></script>
+<multiple name="headscript">   <script type="@headscript.type;literal@"<if @headscript.src@ not nil> src="@headscript.src;literal@"</if><if @headscript.charset@ not nil> charset="@headscript.charset;literal@"</if><if @headscript.defer@ not nil> defer="@headscript.defer;literal@"</if><if @headscript.async@ not nil> async="@headscript.async;literal@"</if><if @headscript.integrity@ not nil> integrity="@headscript.integrity;literal@"</if><if @headscript.crossorigin@ not nil> crossorigin="@headscript.crossorigin;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>><if @headscript.content@ not nil>@headscript.content;noquote@</if></script>
 </multiple>
 
 <if @head@ not nil>@head;literal@</if>
@@ -32,7 +32,7 @@
   @header;literal@
 <slave>
   @footer;literal@
-<multiple name="body_script">    <script type="@body_script.type;literal@"<if @body_script.src@ not nil> src="@body_script.src;literal@"</if><if @body_script.charset@ not nil> charset="@body_script.charset;literal@"</if><if @body_script.defer@ not nil> defer="@body_script.defer;literal@"</if><if @body_script.async@ not nil> async="@body_script.async;literal@"</if><if @body_script.integrity@ not nil> integrity="@body_script.integrity;literal@"</if><if @body_script.crossorigin@ not nil> crossorigin="@body_script.crossorigin;literal@"</if>><if @body_script.content@ not nil>@body_script.content;literal@</if></script>
+<multiple name="body_script">    <script type="@body_script.type;literal@"<if @body_script.src@ not nil> src="@body_script.src;literal@"</if><if @body_script.charset@ not nil> charset="@body_script.charset;literal@"</if><if @body_script.defer@ not nil> defer="@body_script.defer;literal@"</if><if @body_script.async@ not nil> async="@body_script.async;literal@"</if><if @body_script.integrity@ not nil> integrity="@body_script.integrity;literal@"</if><if @body_script.crossorigin@ not nil> crossorigin="@body_script.crossorigin;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>><if @body_script.content@ not nil>@body_script.content;literal@</if></script>
 </multiple>
 
 </body>
Index: openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.tcl,v
diff -u -r1.2.2.5 -r1.2.2.6
--- openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.tcl	3 Jan 2016 21:27:35 -0000	1.2.2.5
+++ openacs-4/packages/acs-bootstrap-installer/installer/www/blank-master.tcl	6 Sep 2016 17:33:55 -0000	1.2.2.6
@@ -53,7 +53,9 @@
   @see template::add_footer
  
   @author Kevin Scaldeferri (kevin@arsdigita.com)
-          Lee Denison (lee@xarg.co.uk)
+    Lee Denison (lee@xarg.co.uk)
+    Gustaf Neumann
+    
   @creation-date 14 Sept 2000
 
   $Id$
@@ -70,7 +72,22 @@
     -name generator \
     -lang en \
     -content "OpenACS version [ad_acs_version]"
-    
+
+#
+# Add the content security policy. Since this is the blank master, we
+# are defensive and check, if the system has already support for it
+# via the CSPEnabledP kernel parameter. Otherwise users would be
+# blocked out.
+#
+if {[parameter::get -parameter CSPEnabledP -package_id [ad_acs_kernel_id] -default 0]
+    && [info commands ::security::csp::render] ne ""
+} {
+    set csp [::security::csp::render]
+    if {$csp ne ""} {
+        ns_set put [ns_conn outputheaders] Content-Security-Policy $csp
+    }
+}
+
 # Add standard javascript
 #
 # Include core.js inclusion to the bottom of the body.
@@ -89,9 +106,6 @@
   }
 }
 
-# The following (forms, list and xinha) should
-# be done in acs-templating.
-
 #
 # Add css for the current subsite, defaulting to the old list/form css which was
 # hard-wired in previous versions of OpenACS.
Index: openacs-4/packages/acs-kernel/acs-kernel.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-kernel/acs-kernel.info,v
diff -u -r1.136.2.22 -r1.136.2.23
--- openacs-4/packages/acs-kernel/acs-kernel.info	2 Sep 2016 20:08:47 -0000	1.136.2.22
+++ openacs-4/packages/acs-kernel/acs-kernel.info	6 Sep 2016 17:33:55 -0000	1.136.2.23
@@ -9,15 +9,15 @@
     <implements-subsite-p>f</implements-subsite-p>
     <inherit-templates-p>t</inherit-templates-p>
     
-    <version name="5.9.1d17" url="http://openacs.org/repository/download/apm/acs-kernel-5.9.1d17.apm">
+    <version name="5.9.1d18" url="http://openacs.org/repository/download/apm/acs-kernel-5.9.1d18.apm">
         <owner url="mailto:oct@openacs.org">OpenACS Core Team</owner>
         <summary>Routines and data models providing the foundation for OpenACS-based Web services.</summary>
-        <release-date>2016-09-02</release-date>
+        <release-date>2016-09-06</release-date>
         <vendor url="http://openacs.org">OpenACS</vendor>
         <description format="text/html">The OpenACS kernel contains the core datamodel create and drop scripts for such things as objects, groups, partiies and the supporting PL/SQL and PL/pgSQL procedures.</description>
         <maturity>3</maturity>
 
-        <provides url="acs-kernel" version="5.9.1d17"/>
+        <provides url="acs-kernel" version="5.9.1d18"/>
 
         <callbacks>
         </callbacks>
@@ -29,6 +29,7 @@
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowedTag"  default="A ADDRESS B BLOCKQUOTE BR CODE DIV DD DL DT EM FONT HR I LI OL P PRE SPAN STRIKE STRONG SUB SUP TABLE TBODY TD TR TT U UL EMAIL FIRST_NAMES LAST_NAME GROUP_NAME H1 H2 H3 H4 H5 H6" description="A space separated list of all the HTML tags that people may use. Add a * to always allow all tags." section_name="antispam"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="ApprovalExpirationDays"  default="0" description="The number of days after which registration approval expires, which will cause the user to change state to &#39;needs_approval&#39;. Set to 0 to disable expiration of approval." section_name="security"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="BugTrackerInstance"  description="Use this parameter to indicate the instance of the bug tracker where the errors will be automatically submited. You must use a relative url indicating where is mounted the instance of the bug tracker. For instance, if you have your bug tracker instance mounted under &#34;/bug&#34;, this parameter must be &#34;/bug&#34;.  Leave this parameter in blank if you do not want to use it." section_name="request-processor"/>
+            <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="CSPEnabledP"  default="1" description="Enable automated generation of W3C ontent Security Policies (CSP)" section_name="security"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="CanonicalServer"  description="In the list of IPs above, which is the canonical (primary) server? If a port is not listed, we assume port 80." section_name="server-cluster"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="ClusterAuthorizedIP"  description="A space separated list of which machines can issues requests (e.g., flushing) to the cluster. Can use glob matching notation (10.0.0.*)" section_name="server-cluster"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="ClusterEnabledP"  default="0" description="is clustering enabled?" section_name="server-cluster"/>
@@ -69,7 +70,6 @@
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="RestrictErrorsToAdminsP"  default="1" description="Whether we show errors to adminstrators only"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="RestrictLoginToSSLP"  default="1" description="Should login, register, and password update pages be restricted to HTTPS?" section_name="security"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="ScreenName"  default="solicit" description="Can be &#39;none&#39;, &#39;solicit&#39;, or &#39;require&#39;. If you say none, we will not ask users to provide a screen_name. If you say &#39;solicit&#39;, we will ask for one, but not require it. If you say &#39;require&#39;, we will not let users register or login without setting up a screen_name." section_name="Local Accounts"/>
-            <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="SecureSessionCookie"  default="0" description="Set this parameter to 1 in order to set for the ad_session cookie the &#34;secure&#34; flag to make it harder to sniff this cookie. This option can be used, when all session are purely https." section_name="security"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="SendErrorEmailP"  default="0" description="Whether to send an email to the site owner describing details whenever an error ocurrs, or not. A value of 0 in this parameter indicates that no emails are goint to be send, in the other hand, a value of 1 indicates that an email is going to be send when error ocurrs.  "/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="ServeXQLFiles"  default="0" description="Should we serve .xql files (database query files) to browsers? Say 0 to not serve them, 1 to serve them. Typically you do not want to serve these files. Requires a server restart to take effect." section_name="request-processor"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="SessionLifetime"  default="604800" description="how long after the last hit should we save information in the SessionLifetime table?" section_name="security"/>
Index: openacs-4/packages/acs-tcl/acs-tcl.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/acs-tcl.info,v
diff -u -r1.70.2.18 -r1.70.2.19
--- openacs-4/packages/acs-tcl/acs-tcl.info	2 Sep 2016 17:33:19 -0000	1.70.2.18
+++ openacs-4/packages/acs-tcl/acs-tcl.info	6 Sep 2016 17:33:55 -0000	1.70.2.19
@@ -9,7 +9,7 @@
     <implements-subsite-p>f</implements-subsite-p>
     <inherit-templates-p>t</inherit-templates-p>
     
-    <version name="5.9.1d10" url="http://openacs.org/repository/download/apm/acs-tcl-5.9.1d10.apm">
+    <version name="5.9.1d11" url="http://openacs.org/repository/download/apm/acs-tcl-5.9.1d11.apm">
         <owner url="http://openacs.org">OpenACS</owner>
         <summary>The Kernel Tcl API library.</summary>
         <release-date>2016-05-15</release-date>
@@ -18,7 +18,7 @@
         <license>GPL version 2</license>
         <maturity>3</maturity>
 
-        <provides url="acs-tcl" version="5.9.1d10"/>
+        <provides url="acs-tcl" version="5.9.1d11"/>
         <requires url="acs-bootstrap-installer" version="5.9.0"/>
         <requires url="acs-kernel" version="5.9.1d11"/>
 
Index: openacs-4/packages/acs-tcl/tcl/security-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/security-procs.tcl,v
diff -u -r1.78.2.25 -r1.78.2.26
--- openacs-4/packages/acs-tcl/tcl/security-procs.tcl	6 Sep 2016 08:14:44 -0000	1.78.2.25
+++ openacs-4/packages/acs-tcl/tcl/security-procs.tcl	6 Sep 2016 17:33:55 -0000	1.78.2.26
@@ -176,9 +176,10 @@
         }
         
         #
-        # generate a csrf token
+        # generate a csrf token and a csp nonce value
         #
         security::csrf::new
+        security::csp::nonce
     }
 }
 
@@ -1970,46 +1971,136 @@
     return ""
 }
 
+namespace eval ::security::csp {
 
-#
-# Generate a nonce token as described in W3C Content Security Policy
-# https://www.w3.org/TR/CSP/
-#
-ad_proc -public ::security::nonce_token { {-tokenname __nonce_token} } {
+    #
+    # Generate a nonce token as described in W3C Content Security Policy
+    # https://www.w3.org/TR/CSP/
+    #
+    ad_proc -public ::security::csp::nonce { {-tokenname __csp_nonce} } {
     
-    Generate a Nonce token and return it. The nonce token can be used
-    in content security policies (CSP2) for "script" and "style"
-    elements. Desired Properties: generate a single unique value per
-    request which is hard for a hacker to predict, it should only
-    contain base64 characters (so hex is fine).
+        Generate a Nonce token and return it. The nonce token can be used
+        in content security policies (CSP2) for "script" and "style"
+        elements. Desired Properties: generate a single unique value per
+        request which is hard for a hacker to predict, it should only
+        contain base64 characters (so hex is fine).
+        
+        For details, see https://www.w3.org/TR/CSP/
+        
+        @return nonce token
+        @author Gustaf Neumann
+    } {
+        #
+        # Compute the nonce value only once per requests. If it was
+        # already computed, pick it up and return the precomputed
+        # value. Otherwise, compute the value new.
+        #
+        set globalTokenName ::$tokenname
+        if {[info exists $globalTokenName]} {
+            set token [set $globalTokenName]
+        } else {
+            set session_id [::security::csrf::session_id]
+            set secret [ns_config "ns/server/[ns_info server]/acs" parametersecret ""]
+            
+            if {[info commands ::crypto::hmac] ne ""} {
+                set token  [::crypto::hmac string $secret $session_id-[clock clicks -microseconds]]
+            } else {
+                set token  [ns_sha1 "$secret-$session_id-[clock clicks -microseconds]"]
+            }
+            set $globalTokenName $token
+        }
+        return $token
+    }
 
-    For details, see https://www.w3.org/TR/CSP/
+    # security::csp::require style-src 'unsafe-inline'
+    ad_proc -public ::security::csp::require {directive value} {
+        Add a single value to a CSP directive
+        @directive name of the directive (such as e.g. style-src)
+        @value allowed source for this page (such as e.g. unsafe-inline)
+    } {
+        set var ::__csp__directive($directive)
+        if {![info exists $var] || $value ni [set $var]} {
+            lappend $var $value
+        }
+    }
 
-    @return nonce token
-    @author Gustaf Neumann
-} {
-    #
-    # Compute the nonce value only once per requests. If it was
-    # already computed, pick it up and return the precomputed
-    # value. Otherwise, compute the value new.
-    #
-    set globalTokenName ::$tokenname
-    if {[info exists $globalTokenName]} {
-        set token [set $globalTokenName]
-    } else {
-        set session_id [::security::csrf::session_id]
-        set secret [ns_config "ns/server/[ns_info server]/acs" parametersecret ""]
+    ad_proc -public ::security::csp::render {} {
+    } {
+        #
+        # Fetch the nonce token
+        #
+        set nonce [::security::nonce_token]
 
-        if {[info commands ::crypto::hmac] ne ""} {
-            set token  [::crypto::hmac string $secret $session_id-[clock clicks -microseconds]]
-        } else {
-            set token  [ns_sha1 "$secret-$session_id-[clock clicks -microseconds]"]
+        #
+        # Add 'self' rules
+        #
+        security::csp::require default-src 'self'
+        security::csp::require script-src 'self'
+        security::csp::require style-src 'self'
+
+        #
+        # Always add the nonce-token to script-src
+        #
+        security::csp::require script-src 'nonce-$nonce'
+        
+        # We need for the time being 'unsafe-inline' for style-src,
+        # otherwise not even the style attribute (e.g. <p
+        # style="...">) would be allowed.
+        #
+        security::csp::require style-src 'unsafe-inline'
+        
+        #
+        # Check for invalid combination to avoid unexpected behavior
+        #
+        foreach directive {script-src style-src} {
+            #
+            # The combination of 'unsafe-inline' with a hash or nonce is
+            # not possible, since 'unsafe-inline' is ignored in such
+            # cases.
+            #
+            set var ::__csp__directive($directive)
+            if {[info exists $var] && "'unsafe-inline'" in [set $var]} {
+                foreach prefix {nonce sha256 sha384 sha512} {
+                    set p [lsearch -glob [set $var] '$prefix-*']
+                    if {$p > -1} {
+                        set $var [lreplace [set $var] $p $p]
+                    }
+                }
+            }
         }
-        set $globalTokenName $token
+
+        set policy ""
+        foreach directive {
+            child-src
+            connect-src
+            default-src
+            font-src
+            form-action
+            frame-src
+            frome-ancestors
+            img-src
+            media-src
+            object-src
+            plugin-types
+            report-uri
+            sandbox
+            script-src
+            style-src
+        } {
+            set var ::__csp__directive($directive)
+            if {[info exists $var]} {
+                append policy "$directive [join [set $var] { }];"
+            }
+        }
+        return $policy
     }
-    return $token
+
 }
 
+#TODO remove me: just for a transition phase
+proc ::security::nonce_token args {uplevel ::security::csp::nonce {*}$args}
+
+
 namespace eval ::security::csrf {
 
     #
Index: openacs-4/www/blank-master.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/www/blank-master.adp,v
diff -u -r1.31.2.1 -r1.31.2.2
--- openacs-4/www/blank-master.adp	5 Sep 2016 11:34:40 -0000	1.31.2.1
+++ openacs-4/www/blank-master.adp	6 Sep 2016 17:33:55 -0000	1.31.2.2
@@ -8,7 +8,7 @@
 <multiple name="link">    <link rel="@link.rel;literal@" href="@link.href@"<if @link.lang@ not nil and @link.lang;literal@ ne @doc.lang;literal@> lang="@link.lang;literal@"</if><if @link.title@ not nil> title="@link.title@"</if><if @link.type@ not nil> type="@link.type;literal@"</if><if @link.media@ not nil> media="@link.media;literal@"</if><if @link.integrity@ not nil> integrity="@link.integrity;literal@"</if><if @link.crossorigin@ not nil> crossorigin="@link.crossorigin;literal@"</if>>
 </multiple>
 
-<multiple name="___style"> <style type="@___style.type;literal@" <if @___style.lang@ not nil and @___style.lang;literal@ ne @doc.lang;literal@> lang="@___style.lang;literal@"</if><if @___style.title@ not nil> title="@___style.title@"</if><if @___style.media@ not nil> media="@___style.media;literal@"</if>>@___style.style;literal@
+<multiple name="___style"> <style type="@___style.type;literal@" <if @___style.lang@ not nil and @___style.lang;literal@ ne @doc.lang;literal@> lang="@___style.lang;literal@"</if><if @___style.title@ not nil> title="@___style.title@"</if><if @___style.media@ not nil> media="@___style.media;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>>@___style.style;literal@
 </style>
 </multiple>
 
@@ -23,7 +23,7 @@
 </script>
 </if>
 
-<multiple name="headscript">   <script type="@headscript.type;literal@"<if @headscript.src@ not nil> src="@headscript.src;literal@"</if><if @headscript.charset@ not nil> charset="@headscript.charset;literal@"</if><if @headscript.defer@ not nil> defer="@headscript.defer;literal@"</if><if @headscript.async@ not nil> async="@headscript.async;literal@"</if><if @headscript.integrity@ not nil> integrity="@headscript.integrity;literal@"</if><if @headscript.crossorigin@ not nil> crossorigin="@headscript.crossorigin;literal@"</if>><if @headscript.content@ not nil>@headscript.content;noquote@</if></script>
+<multiple name="headscript">   <script type="@headscript.type;literal@"<if @headscript.src@ not nil> src="@headscript.src;literal@"</if><if @headscript.charset@ not nil> charset="@headscript.charset;literal@"</if><if @headscript.defer@ not nil> defer="@headscript.defer;literal@"</if><if @headscript.async@ not nil> async="@headscript.async;literal@"</if><if @headscript.integrity@ not nil> integrity="@headscript.integrity;literal@"</if><if @headscript.crossorigin@ not nil> crossorigin="@headscript.crossorigin;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>><if @headscript.content@ not nil>@headscript.content;noquote@</if></script>
 </multiple>
 
 <if @head@ not nil>@head;literal@</if>
@@ -32,7 +32,7 @@
   @header;literal@
 <slave>
   @footer;literal@
-<multiple name="body_script">    <script type="@body_script.type;literal@"<if @body_script.src@ not nil> src="@body_script.src;literal@"</if><if @body_script.charset@ not nil> charset="@body_script.charset;literal@"</if><if @body_script.defer@ not nil> defer="@body_script.defer;literal@"</if><if @body_script.async@ not nil> async="@body_script.async;literal@"</if><if @body_script.integrity@ not nil> integrity="@body_script.integrity;literal@"</if><if @body_script.crossorigin@ not nil> crossorigin="@body_script.crossorigin;literal@"</if>><if @body_script.content@ not nil>@body_script.content;literal@</if></script>
+<multiple name="body_script">    <script type="@body_script.type;literal@"<if @body_script.src@ not nil> src="@body_script.src;literal@"</if><if @body_script.charset@ not nil> charset="@body_script.charset;literal@"</if><if @body_script.defer@ not nil> defer="@body_script.defer;literal@"</if><if @body_script.async@ not nil> async="@body_script.async;literal@"</if><if @body_script.integrity@ not nil> integrity="@body_script.integrity;literal@"</if><if @body_script.crossorigin@ not nil> crossorigin="@body_script.crossorigin;literal@"</if><if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>><if @body_script.content@ not nil>@body_script.content;literal@</if></script>
 </multiple>
 
 </body>
Index: openacs-4/www/blank-master.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/www/blank-master.tcl,v
diff -u -r1.56.2.6 -r1.56.2.7
--- openacs-4/www/blank-master.tcl	5 Sep 2016 11:32:40 -0000	1.56.2.6
+++ openacs-4/www/blank-master.tcl	6 Sep 2016 17:33:55 -0000	1.56.2.7
@@ -53,7 +53,9 @@
   @see template::add_footer
  
   @author Kevin Scaldeferri (kevin@arsdigita.com)
-          Lee Denison (lee@xarg.co.uk)
+    Lee Denison (lee@xarg.co.uk)
+    Gustaf Neumann
+    
   @creation-date 14 Sept 2000
 
   $Id$
@@ -70,7 +72,22 @@
     -name generator \
     -lang en \
     -content "OpenACS version [ad_acs_version]"
-    
+
+#
+# Add the content security policy. Since this is the blank master, we
+# are defensive and check, if the system has already support for it
+# via the CSPEnabledP kernel parameter. Otherwise users would be
+# blocked out.
+#
+if {[parameter::get -parameter CSPEnabledP -package_id [ad_acs_kernel_id] -default 0]
+    && [info commands ::security::csp::render] ne ""
+} {
+    set csp [::security::csp::render]
+    if {$csp ne ""} {
+        ns_set put [ns_conn outputheaders] Content-Security-Policy $csp
+    }
+}
+
 # Add standard javascript
 #
 # Include core.js inclusion to the bottom of the body.
@@ -89,9 +106,6 @@
   }
 }
 
-# The following (forms, list and xinha) should
-# be done in acs-templating.
-
 #
 # Add css for the current subsite, defaulting to the old list/form css which was
 # hard-wired in previous versions of OpenACS.