Index: openacs-4/packages/xotcl-core/tcl/bgdelivery-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xotcl-core/tcl/bgdelivery-procs.tcl,v
diff -u -r1.49.2.4 -r1.49.2.5
--- openacs-4/packages/xotcl-core/tcl/bgdelivery-procs.tcl	1 Nov 2016 18:54:06 -0000	1.49.2.4
+++ openacs-4/packages/xotcl-core/tcl/bgdelivery-procs.tcl	11 Nov 2016 00:31:10 -0000	1.49.2.5
@@ -328,7 +328,7 @@
     if {[my mode] eq "scripted"} {
       set emsg [encoding convertto utf-8 $msg]
       #ns_log notice "SEND data <$msg> encoded <$emsg>"
-      set smsg "<script type='text/javascript'>\nvar data = $emsg;\n\
+      set smsg "<script type='text/javascript' nonce='$::__csp_nonce'>\nvar data = $emsg;\n\
             parent.getData(data);</script>\n"
       set smsg [format %x [string length $smsg]]\r\n$smsg\r\n
     } else {
Index: openacs-4/packages/xotcl-core/tcl/chat-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xotcl-core/tcl/Attic/chat-procs.tcl,v
diff -u -r1.23.2.4 -r1.23.2.5
--- openacs-4/packages/xotcl-core/tcl/chat-procs.tcl	1 Nov 2016 18:54:06 -0000	1.23.2.4
+++ openacs-4/packages/xotcl-core/tcl/chat-procs.tcl	11 Nov 2016 00:31:10 -0000	1.23.2.5
@@ -279,7 +279,7 @@
 
   Chat instproc js_encode_msg {msg} {
     set json [my json_encode_msg $msg]
-    return "<script type='text/javascript' language='javascript'>
+    return "<script type='text/javascript' language='javascript' nonce='$::__csp_nonce'>
     var data = $json;
     parent.getData(data);
     </script>\n"
Index: openacs-4/packages/xowiki/tcl/chat-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/chat-procs.tcl,v
diff -u -r1.19.2.1 -r1.19.2.2
--- openacs-4/packages/xowiki/tcl/chat-procs.tcl	1 Nov 2016 18:54:06 -0000	1.19.2.1
+++ openacs-4/packages/xowiki/tcl/chat-procs.tcl	11 Nov 2016 00:31:10 -0000	1.19.2.2
@@ -144,7 +144,7 @@
 
     switch $mode {
       polling {return "\
-      <script type='text/javascript' language='javascript'>
+      <script type='text/javascript' language='javascript' nonce='$::__csp_nonce'>
       $js
       setInterval('$get_update',5000)
       </script>
@@ -162,7 +162,7 @@
         set r [ns_urldecode [c1 get_all]]
         regsub -all {<[/]?div[^>]*>} $r "" r
         return "\
-      <script type='text/javascript' language='javascript'>$js
+      <script type='text/javascript' language='javascript' nonce='$::__csp_nonce'>$js
       var send_url = \"$send_url\";
       chatSubscribe(\"$subscribe_url\");
       </script>
@@ -178,7 +178,7 @@
         set r [ns_urldecode [c1 get_all]]
         regsub -all {<[/]?div[^>]*>} $r "" r
         return "\
-      <script type='text/javascript' language='javascript'>
+      <script type='text/javascript' language='javascript' nonce='$::__csp_nonce'>
       $js
       var send_url = \"$send_url\";
       </script>
Index: openacs-4/packages/xowiki/tcl/includelet-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/includelet-procs.tcl,v
diff -u -r1.200.2.24 -r1.200.2.25
--- openacs-4/packages/xowiki/tcl/includelet-procs.tcl	1 Nov 2016 18:54:06 -0000	1.200.2.24
+++ openacs-4/packages/xowiki/tcl/includelet-procs.tcl	11 Nov 2016 00:31:10 -0000	1.200.2.25
@@ -2568,7 +2568,7 @@
 
     if {$allow_reorder ne ""} {
       for {set l $last_level} {$l > 0} {incr l -1} {append output "</ul>\n" }
-      append output "<script type='text/javascript'>$js</script>\n"
+      append output "<script type='text/javascript' nonce='$::__csp_nonce'>$js</script>\n"
     }
     return $output
   }
@@ -2690,8 +2690,7 @@
       <link rel="stylesheet" href="http://www.w3.org/Talks/Tools/Slidy2/styles/slidy.css" type="text/css" media="screen, projection" />
       <link rel="stylesheet" href="print.css" type="text/css"
       media="print" />
-      <script src="http://www.w3.org/Talks/Tools/Slidy2/scripts/slidy.js" type="text/javascript">
-      </script>
+      <script src="http://www.w3.org/Talks/Tools/Slidy2/scripts/slidy.js" type="text/javascript"></script>
       </head>
       <body>
       $output
@@ -3172,7 +3171,7 @@
       <canvas id="collab" width="500" height="500" style="border: 0px solid black">
       </canvas>
       [set nodesHTML]
-      <script type="text/javascript">
+      <script type="text/javascript" nonce='[set ::__csp_nonce]'>
       function draw() {
         if (typeof(G_vmlCanvasManager) == "object") {
           G_vmlCanvasManager.init_(window.document);
@@ -3395,7 +3394,7 @@
 
     return [subst -nocommands -nobackslashes {
       <div id="my-timeline" style="font-size:70%; height: 350px; border: 1px solid #aaa"></div>
-      <script type="text/javascript">
+      <script type="text/javascript" nonce='$::__csp_nonce'>
       var tl;
       function onLoad() {
         var eventSource = new Timeline.DefaultEventSource();
@@ -3694,7 +3693,7 @@
     }
     set values [join $values ",\n"]
     append result [subst -nocommands {
-      <script type='text/javascript'>
+      <script type='text/javascript' nonce='$::__csp_nonce'>
       var chart;
       chart = new Highcharts.Chart({
         chart: {
@@ -4544,7 +4543,7 @@
   flowplayer instproc render {} {
     my get_parameters
     return "<a href='[ns_quotehtml $mp4]' style='display:block;width:425px;height:300px;' id='player'> </a>
-    <script type='text/javascript'>
+    <script type='text/javascript' nonce='$::__csp_nonce'>
  flowplayer('player', '/resources/xowiki/flowplayer/flowplayer-3.2.7.swf', {
         
     // this will enable pseudostreaming support 
Index: openacs-4/packages/xowiki/tcl/link-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/tcl/link-procs.tcl,v
diff -u -r1.96.2.7 -r1.96.2.8
--- openacs-4/packages/xowiki/tcl/link-procs.tcl	5 Nov 2016 17:52:17 -0000	1.96.2.7
+++ openacs-4/packages/xowiki/tcl/link-procs.tcl	11 Nov 2016 00:31:10 -0000	1.96.2.8
@@ -299,7 +299,7 @@
     </div>
   </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->
-<script>    
+<script type='text/javascript' nonce='$::__csp_nonce'>
 \$('.modal').on('show.bs.modal', function(event) {
     var idx = \$('.modal:visible').length;
     \$(this).css('z-index', 1040 + (10 * idx));
@@ -325,7 +325,7 @@
     </div>
   </div><!-- /.modal-dialog -->
 </div><!-- /.modal -->
-<script>    
+<script type='text/javascript' nonce='$::__csp_nonce'>
 \$('.modal').on('show.bs.modal', function(event) {
     var idx = \$('.modal:visible').length;
     \$(this).css('z-index', 1040 + (10 * idx));
@@ -550,7 +550,7 @@
     }
     
     return "<div id='[ns_quotehtml $id]'>$label</div>
-    <script type='text/javascript'>
+    <script type='text/javascript' nonce='$::__csp_nonce'>
     var so = new SWFObject('[ns_quotehtml $href]', '[ns_quotehtml $name]', '[ns_quotehtml $width]', '[ns_quotehtml $height]', '[ns_quotehtml $version]');
     $addParams so.write('$id');
     </script>