Index: openacs-4/packages/acs-kernel/acs-kernel.info
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-kernel/acs-kernel.info,v
diff -u -r1.136.2.23 -r1.136.2.24
--- openacs-4/packages/acs-kernel/acs-kernel.info	6 Sep 2016 17:33:55 -0000	1.136.2.23
+++ openacs-4/packages/acs-kernel/acs-kernel.info	11 Nov 2016 00:09:20 -0000	1.136.2.24
@@ -24,7 +24,7 @@
         <parameters>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AdminOwner"  default="a-programmer@yourdomain.com" description="who signs the admin pages, e.g., a programmer who can fix/enhance them" section_name="system-information"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowPersistentLoginP"  default="1" description="do we allow persistent logins?" section_name="security"/>
-            <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowedAttribute"  default="align alt border cellpadding cellspacing color face height href hspace id name size src style target title valign vspace width" description="A space separated list of allowed attribute names, e.g. title, src, etc.. You probably want to avoid onMouseOver and the like. Add a * to always allow all attributes." section_name="antispam"/>
+            <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowedAttribute"  default="align alt border cellpadding cellspacing color face height href hspace id name size src style target title valign vspace width colspan rowspan class" description="A space separated list of allowed attribute names, e.g. title, src, etc.. You probably want to avoid onMouseOver and the like. Add a * to always allow all attributes." section_name="antispam"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowedProtocol"  default="http https ftp mailto" description="A space separated list of protocols that are valid attributes of HTML tags in submitted content. Add a * to always all all protocols." section_name="antispam"/>
             <parameter scope="instance" datatype="string"  min_n_values="1"  max_n_values="1"  name="AllowedTag"  default="A ADDRESS B BLOCKQUOTE BR CODE DIV DD DL DT EM FONT HR I LI OL P PRE SPAN STRIKE STRONG SUB SUP TABLE TBODY TD TR TT U UL EMAIL FIRST_NAMES LAST_NAME GROUP_NAME H1 H2 H3 H4 H5 H6" description="A space separated list of all the HTML tags that people may use. Add a * to always allow all tags." section_name="antispam"/>
             <parameter scope="instance" datatype="number"  min_n_values="1"  max_n_values="1"  name="ApprovalExpirationDays"  default="0" description="The number of days after which registration approval expires, which will cause the user to change state to &#39;needs_approval&#39;. Set to 0 to disable expiration of approval." section_name="security"/>
Index: openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl,v
diff -u -r1.48.2.5 -r1.48.2.6
--- openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl	28 Apr 2016 12:52:08 -0000	1.48.2.5
+++ openacs-4/packages/acs-lang/tcl/lang-util-procs.tcl	11 Nov 2016 00:09:20 -0000	1.48.2.6
@@ -665,6 +665,9 @@
     if { [ad_conn isconnected] } {
         # There is an HTTP connection - return the client property
         set ::acs_translator_mode_p [ad_get_client_property -default 0 acs-lang translator_mode_p]
+        if {$::acs_translator_mode_p eq ""} {
+            set ::acs_translator_mode_p 0
+        }
     } else {
         # No HTTP connection
         set ::acs_translator_mode_p 0
Index: openacs-4/packages/evaluation/www/admin/tasks/task-add-edit.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/evaluation/www/admin/tasks/task-add-edit.adp,v
diff -u -r1.7 -r1.7.2.1
--- openacs-4/packages/evaluation/www/admin/tasks/task-add-edit.adp	3 Jul 2015 10:47:37 -0000	1.7
+++ openacs-4/packages/evaluation/www/admin/tasks/task-add-edit.adp	11 Nov 2016 00:09:20 -0000	1.7.2.1
@@ -2,7 +2,7 @@
   <property name="doc(title)">@page_title;literal@</property>
   <property name="context">@context;literal@</property>
 
-<script type="text/javascript">
+<script type="text/javascript"<if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>>
 	var browserType;
 
 	if (document.layers) {browserType = "nn4"}
Index: openacs-4/packages/forums/lib/message/row2.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/forums/lib/message/row2.adp,v
diff -u -r1.3.2.2 -r1.3.2.3
--- openacs-4/packages/forums/lib/message/row2.adp	6 Nov 2016 11:04:21 -0000	1.3.2.2
+++ openacs-4/packages/forums/lib/message/row2.adp	11 Nov 2016 00:09:20 -0000	1.3.2.3
@@ -105,15 +105,4 @@
  </div>
 </div>
 
-<!-------------- For IE  --------------->
-
- <if @rownum@ eq 0>
-     <SCRIPT FOR="window" EVENT="onload" LANGUAGE="JScript">
-          showExpandedOnLoad('@message.message_id@','@children_direct_list@','@children_string@');
-     </SCRIPT>
- </if>
- 
-
- <!--------------For other browsers --------------->
-      <body onload="showExpandedOnLoad('@message.message_id@','@children_direct_list@','@children_string@')">
      
Index: openacs-4/packages/forums/lib/message/row2.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/forums/lib/message/row2.tcl,v
diff -u -r1.3.2.2 -r1.3.2.3
--- openacs-4/packages/forums/lib/message/row2.tcl	6 Nov 2016 11:03:00 -0000	1.3.2.2
+++ openacs-4/packages/forums/lib/message/row2.tcl	11 Nov 2016 00:09:20 -0000	1.3.2.3
@@ -100,7 +100,11 @@
     }]
 }
 
+template::add_body_handler -event onload -script [subst {
+    showExpandedOnLoad('$message(message_id)','$children_direct_list','$children_string');
+}]
 
+
 # Local variables:
 #    mode: tcl
 #    tcl-indent-level: 4
Index: openacs-4/packages/forums/www/messages-get.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/forums/www/messages-get.adp,v
diff -u -r1.3 -r1.3.10.1
--- openacs-4/packages/forums/www/messages-get.adp	15 Dec 2006 22:45:34 -0000	1.3
+++ openacs-4/packages/forums/www/messages-get.adp	11 Nov 2016 00:09:21 -0000	1.3.10.1
@@ -2,17 +2,17 @@
   <head>
     <title>nan</title>
     <script type="text/javascript" src="/resources/forums/dynamic-comments.js"></script>
-    <script language="JavaScript" TYPE="text/javascript"><!--
+    <script language="JavaScript" type="text/javascript"<if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>>
       collapse_symbol = '<img src="/resources/forums/Collapse16.gif" width="16" height="16" ALT="-" border="0" title="collapse message">';
       expand_symbol = '<img src="/resources/forums/Expand16.gif" width="16" height="16" ALT="+" border="0" title="expand message">';
       loading_symbol = '<img src="/resources/forums/dyn_wait.gif" width="12" height="16" ALT="x" border="0">';
       loading_message = 'Loading...';
       rootdir = 'messages-get';
       sid = '@sid@';
-      //--></script>
+    </script>
   </head>
-  <iframe width="0" height="0" border="0" style="width:0;height:0;border:0;" ID="dynamic" NAME="dynamic" SRC="about:blank" title=""></IFRAME>
-  <body onload="copyContent(@cid@,@dynamicmode@)">
+  <iframe width="0" height="0" border="0" style="width:0;height:0;border:0;" id="dynamic" name="dynamic" src="about:blank" title=""></iframe>
+  <body>
     <div id="@cid@"><div>@message.content;noquote@</div></div>
   </body>
 </html>
Index: openacs-4/packages/forums/www/messages-get.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/forums/www/messages-get.tcl,v
diff -u -r1.2.14.1 -r1.2.14.2
--- openacs-4/packages/forums/www/messages-get.tcl	12 Sep 2015 11:06:28 -0000	1.2.14.1
+++ openacs-4/packages/forums/www/messages-get.tcl	11 Nov 2016 00:09:21 -0000	1.2.14.2
@@ -13,6 +13,9 @@
     set message(content) {}
 }
 
+template::add_body_handler -event onload -script [subst {
+    copyContent('$cid','$dynamicmode');
+}]
 
 # Local variables:
 #    mode: tcl
Index: openacs-4/packages/xotcl-core/tcl/05-db-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xotcl-core/tcl/05-db-procs.tcl,v
diff -u -r1.103.2.10 -r1.103.2.11
--- openacs-4/packages/xotcl-core/tcl/05-db-procs.tcl	14 Oct 2016 19:22:11 -0000	1.103.2.10
+++ openacs-4/packages/xotcl-core/tcl/05-db-procs.tcl	11 Nov 2016 00:09:21 -0000	1.103.2.11
@@ -467,6 +467,7 @@
     #if {$sql eq ""} {set sql [my get_sql $qn]}
     if {$bind ne ""} {set bindOpt [list -bind $bind]} {set bindOpt ""}
     set qn [uplevel [list [self] qn $qn]]
+    #ns_log notice "### [list ::db_foreach -dbn $dbn $qn $sql $body {*}$bindOpt]"
     uplevel [list ::db_foreach -dbn $dbn $qn $sql $body {*}$bindOpt]
   }