Fixes #11

CSP ISSUES Add missing nonces everywhere + add strict dynamic
2023-03-23 16:02:56 +01:00 · 2023-03-23 16:02:56 +01:00 · c0d8fdb73f
commit c0d8fdb73f
parent 58bbdafe43
56 changed files with 71 additions and 75 deletions
--- a/app/Http/Middleware/SecureHeaders.php
+++ b/app/Http/Middleware/SecureHeaders.php
@ -32,7 +32,7 @@ class SecureHeaders
    {
        View::share('nonce', $nonce = \uniqid());
        // * For VueJS dev tool to execute
-        $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-$nonce'";
+        $jsDev     = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
        $reportUri = Route::has('cspReportUri') ?
            \sprintf('report-uri %s', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
        $this->removeUnwantedHeaders($this->unwantedHeaderList);
--- a/resources/views/bo/actus/form-inputs.blade.php
+++ b/resources/views/bo/actus/form-inputs.blade.php
@ -66,7 +66,7 @@
 </div>

@section('scripts')
-<script type="text/javascript">
+<script nonce="{{ $nonce }}">
 $('.tag_actu').click(function(event) {
    if ($('.tag_actu:checked').length > 8) {
        event.preventDefault();
--- a/resources/views/bo/actus/highlights.blade.php
+++ b/resources/views/bo/actus/highlights.blade.php
@ -30,7 +30,7 @@
@endsection

@section('scripts')
-    <script type="text/javascript">
+    <script nonce="{{ $nonce }}">
        $('.cb_actu').click(function(event) {
            if ($('.cb_actu:checked').length > 3) {
                event.preventDefault();
--- a/resources/views/bo/articles/create.blade.php
+++ b/resources/views/bo/articles/create.blade.php
@ -91,7 +91,7 @@
@endsection

@section('scripts')
-    <script>
+    <script nonce="{{ $nonce }}">
        var addId = 0;
        // Compte le nombre de champs answer sur la page
        var nbAnswer = 0;
--- a/resources/views/bo/articles/edit.blade.php
+++ b/resources/views/bo/articles/edit.blade.php
@ -128,7 +128,7 @@
@endsection

@section('scripts')
-    <script>
+    <script nonce="{{ $nonce }}">
        var addId = 0;
        // Compte le nombre de champs answer sur la page
        var nbAnswer = 0;
--- a/resources/views/bo/breeding-page/form-inputs.blade.php
+++ b/resources/views/bo/breeding-page/form-inputs.blade.php
@ -79,7 +79,7 @@
    </label>
 </div>
@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $(document).ready(function() {
    var __switchMediaType = function() {
        if(
--- a/resources/views/bo/danslespres/form.blade.php
+++ b/resources/views/bo/danslespres/form.blade.php
@ -46,7 +46,7 @@

@push('scripts')

-<script>
+<script nonce="{{ $nonce }}">

 document.addEventListener('DOMContentLoaded', function() {
    const isVideo = document.getElementById('isVideo'),
--- a/resources/views/bo/engagements/edit.blade.php
+++ b/resources/views/bo/engagements/edit.blade.php
@ -25,7 +25,7 @@
@endsection

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $('#engagementForm').on('submit', function(e) {
    $('input[type="file"]').each(function(i, img) {
        if ($(img).data('old-value') && !$(img).val()) {
--- a/resources/views/bo/engagements/form-inputs.blade.php
+++ b/resources/views/bo/engagements/form-inputs.blade.php
@ -139,7 +139,7 @@ $content = $engagement->content;
    </label>
 </div>
@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $(document).ready(function() {
    var cloneFn = function(e) {
        e.preventDefault();
--- a/resources/views/bo/joinus/index.blade.php
+++ b/resources/views/bo/joinus/index.blade.php
@ -50,9 +50,3 @@
        </div>
    </div>
@endsection
-
-@section('scripts')
-    <script type="text/javascript" defer>
-
-    </script>
-@endsection
--- a/resources/views/bo/modules/mini-acf/dropdown-input.blade.php
+++ b/resources/views/bo/modules/mini-acf/dropdown-input.blade.php
@ -19,7 +19,7 @@ $o = $o ?? 'X';
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/mini-acf/form-inputs.blade.php
+++ b/resources/views/bo/modules/mini-acf/form-inputs.blade.php
@ -190,7 +190,7 @@
@endforeach

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/mini-acf/image-input.blade.php
+++ b/resources/views/bo/modules/mini-acf/image-input.blade.php
@ -14,7 +14,7 @@
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/mini-acf/label-input.blade.php
+++ b/resources/views/bo/modules/mini-acf/label-input.blade.php
@ -22,7 +22,7 @@ $o = $o ?? 'X';
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/mini-acf/minibloc-input.blade.php
+++ b/resources/views/bo/modules/mini-acf/minibloc-input.blade.php
@ -21,7 +21,7 @@ $o = $o ?? 'X';
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/mini-acf/vimeoVideo-input.blade.php
+++ b/resources/views/bo/modules/mini-acf/vimeoVideo-input.blade.php
@ -5,7 +5,7 @@
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 if(!__MINIACF) {
    var __MINIACF = {};
 }
--- a/resources/views/bo/modules/minicrud-form-inputs.blade.php
+++ b/resources/views/bo/modules/minicrud-form-inputs.blade.php
@ -62,7 +62,7 @@
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $('#minicrud').parents('form').on('submit', function(e) {
    $('input[type="file"]').each(function(i, img) {
        if ($(img).data('old-value') && !$(img).val()) {
--- a/resources/views/bo/moments/create.blade.php
+++ b/resources/views/bo/moments/create.blade.php
@ -134,7 +134,7 @@
@endsection

@section('scripts')
-    <script type="text/javascript">
+    <script nonce="{{ $nonce }}">
        // Pour enregistré la couleur précédement choisie
        var previous = '';

--- a/resources/views/bo/moments/edit.blade.php
+++ b/resources/views/bo/moments/edit.blade.php
@ -178,7 +178,7 @@
@endsection

@section('scripts')
-    <script type="text/javascript">
+    <script nonce="{{ $nonce }}">
        // Pour enregistré la couleur précédement choisie
        var previous = '';

--- a/resources/views/bo/nutrition-page/edit.blade.php
+++ b/resources/views/bo/nutrition-page/edit.blade.php
@ -24,7 +24,7 @@
@endsection

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $('#nutritionForm').on('submit', function(e) {
    $('input[type="file"]').each(function(i, img) {
        if ($(img).data('old-value') && !$(img).val()) {
--- a/resources/views/bo/ocbbreeders/formInputs.blade.php
+++ b/resources/views/bo/ocbbreeders/formInputs.blade.php
@ -142,7 +142,7 @@
 </div>

@section('scripts')
-    <script type="text/javascript" defer>
+    <script nonce="{{ $nonce }}">
        var addId = 1;

        var videoDiv = $("#div_video_link");
--- a/resources/views/bo/products/create.blade.php
+++ b/resources/views/bo/products/create.blade.php
@ -17,8 +17,8 @@
@endsection

@section('scripts')
-<script src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js" integrity="sha512-uto9mlQzrs59VwILcLiRYeLKPPbS/bT71da/OEBYEwcdNUk8jYIy+D176RYoop1Da+f9mvkYrmj5MCLZWEtQuA==" crossorigin="anonymous"></script>
-<script>
+<script nonce="{{ $nonce }}" src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js" integrity="sha512-uto9mlQzrs59VwILcLiRYeLKPPbS/bT71da/OEBYEwcdNUk8jYIy+D176RYoop1Da+f9mvkYrmj5MCLZWEtQuA==" crossorigin="anonymous"></script>
+<script nonce="{{ $nonce }}">
    var ficheInco;
    $('#xml_inco').autocomplete({
        source: function(request, res) {
@ -116,4 +116,4 @@
        display: none;
    }
 </style>
-@endsection
+@endsection
--- a/resources/views/bo/products/edit.blade.php
+++ b/resources/views/bo/products/edit.blade.php
@ -28,8 +28,8 @@
@endsection

@section('scripts')
-<script src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js" integrity="sha512-uto9mlQzrs59VwILcLiRYeLKPPbS/bT71da/OEBYEwcdNUk8jYIy+D176RYoop1Da+f9mvkYrmj5MCLZWEtQuA==" crossorigin="anonymous"></script>
-<script>
+<script nonce="{{ $nonce }}" src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js" integrity="sha512-uto9mlQzrs59VwILcLiRYeLKPPbS/bT71da/OEBYEwcdNUk8jYIy+D176RYoop1Da+f9mvkYrmj5MCLZWEtQuA==" crossorigin="anonymous"></script>
+<script nonce="{{ $nonce }}">
    var label = $('#xml_inco').val();
    var availableTags = [
        { label: 'Andorra', value: 1 },
@ -88,4 +88,4 @@
        display: none;
    }
 </style>
-@endsection
+@endsection
--- a/resources/views/bo/products/form-inputs.blade.php
+++ b/resources/views/bo/products/form-inputs.blade.php
@ -270,7 +270,7 @@
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 $(document).ready(function() {
    let resetSubRanges = function () {
        let optionSelected = $("#range_id option:selected").data('subrange');
--- a/resources/views/bo/recipes/form-inputs.blade.php
+++ b/resources/views/bo/recipes/form-inputs.blade.php
@ -129,7 +129,7 @@
 </div>

@section('scripts')
-<script type="application/javascript">
+<script nonce="{{ $nonce }}">
    $(document).ready(function() {
        if ($("[name=type]:checked").val() == "{{RecipeType::video()->value}}") {
            $("#video_link").show();
--- a/resources/views/bo/recipes/highlights.blade.php
+++ b/resources/views/bo/recipes/highlights.blade.php
@ -30,7 +30,7 @@
@endsection

@section('scripts')
-    <script type="text/javascript">
+    <script nonce="{{ $nonce }}">
        $('.cb_recipe').click(function(event) {
            if ($('.cb_recipe:checked').length > 3) {
                event.target.checked = false;
--- a/resources/views/front/actu/index.blade.php
+++ b/resources/views/front/actu/index.blade.php
@ -25,7 +25,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/actu/show.blade.php
+++ b/resources/views/front/actu/show.blade.php
@ -86,7 +86,7 @@
@endsection

@push('scripts')
-    <script>
+    <script nonce="{{ $nonce }}">
        __Gaul.handleMediaShares()
    </script>
@endpush
--- a/resources/views/front/brand/ads.blade.php
+++ b/resources/views/front/brand/ads.blade.php
@ -75,7 +75,7 @@
@endsection

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 for(let video of document.querySelectorAll('.video a')) {
    video.onclick = function(e) {
        e.preventDefault();
--- a/resources/views/front/brand/history.blade.php
+++ b/resources/views/front/brand/history.blade.php
@ -272,7 +272,7 @@
@endpush

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 window.odometerOptions = {
    format: 'd'
 };
--- a/resources/views/front/brand/index.blade.php
+++ b/resources/views/front/brand/index.blade.php
@ -76,7 +76,7 @@
@endsection

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 (function() {
    document.querySelector('.brand > h3').classList.add(['animated', 'delay-1s', 'fadeInUp']);
    document.querySelector('.brand > p').classList.add(['animated', 'delay-1s', 'fadeInUp']);
--- a/resources/views/front/ck-videos.blade.php
+++ b/resources/views/front/ck-videos.blade.php
@ -18,7 +18,7 @@
        </a>
    </div>
 </div>
-<script>
+<script nonce="{{ $nonce }}">
 (function() {
    // ckeditor embeds
    let embeds = document.querySelectorAll('figure.media > oembed');
--- a/resources/views/front/club/article.blade.php
+++ b/resources/views/front/club/article.blade.php
@ -94,7 +94,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/bourse.blade.php
+++ b/resources/views/front/club/bourse.blade.php
@ -27,7 +27,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/boutique/boutique.blade.php
+++ b/resources/views/front/club/boutique/boutique.blade.php
@ -20,7 +20,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/boutique/redirectMercanet.blade.php
+++ b/resources/views/front/club/boutique/redirectMercanet.blade.php
@ -18,5 +18,5 @@
@endsection

@push('scripts')
-<script type="text/javascript">document.redirectForm.submit();</script>
+<script nonce="{{ $nonce }}">document.redirectForm.submit();</script>
@endpush
--- a/resources/views/front/club/cart.blade.php
+++ b/resources/views/front/club/cart.blade.php
@ -30,7 +30,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/favorites-recipes.blade.php
+++ b/resources/views/front/club/favorites-recipes.blade.php
@ -26,7 +26,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/index.blade.php
+++ b/resources/views/front/club/index.blade.php
@ -62,7 +62,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/messages.blade.php
+++ b/resources/views/front/club/messages.blade.php
@ -23,7 +23,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
--- a/resources/views/front/club/reductions.blade.php
+++ b/resources/views/front/club/reductions.blade.php
@ -42,7 +42,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._routes = {
        "club.reductionsGet": "{{ route('club.reductionsGet') }}"
    };
--- a/resources/views/front/contact/contact-form.blade.php
+++ b/resources/views/front/contact/contact-form.blade.php
@ -145,7 +145,7 @@
 </form>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
    document.getElementById('contactMessage').addEventListener('onkeypress', function(e) {
        this.value = this.value.substr(0, 1900);
    });
--- a/resources/views/front/faq/index.blade.php
+++ b/resources/views/front/faq/index.blade.php
@ -83,7 +83,7 @@
 </div>
@endsection
@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._routes = {
        "faq.updateSatisfactionStat": "{{ route('faq.updateSatisfactionStat', '/') }}"
    };
--- a/resources/views/front/ocb/googlemaps.blade.php
+++ b/resources/views/front/ocb/googlemaps.blade.php
@ -3,7 +3,7 @@
 </google-map-markers>

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._locale = '{{ app()->getLocale() }}';
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._asset = '{{ asset('') }}';
@ -15,6 +15,6 @@
@endpush

@push('scripts')
-<script src="https://maps.googleapis.com/maps/api/js?key={{ config('google.apiKey') }}&callback=initMap"></script>
-<script src="{{ asset('js/oms-min.js') }}"></script>
+<script nonce="{{ $nonce }}" src="https://maps.googleapis.com/maps/api/js?key={{ config('google.apiKey') }}&callback=initMap"></script>
+<script nonce="{{ $nonce }}" src="{{ asset('js/oms-min.js') }}"></script>
@endpush
--- a/resources/views/front/ocb/testimonials.blade.php
+++ b/resources/views/front/ocb/testimonials.blade.php
@ -88,7 +88,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._routes = {
        "brand.traceability-search": "{{ route('brand.traceability-search') }}",
        "ocb.breeders": "{{ route('ocb.breeders', ['breeder' => '/']) }}"
--- a/resources/views/front/onepage/index.blade.php
+++ b/resources/views/front/onepage/index.blade.php
@ -439,7 +439,7 @@
@endsection

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
 window.odometerOptions = {
    format: 'd'
 };
--- a/resources/views/front/products/product.blade.php
+++ b/resources/views/front/products/product.blade.php
@ -288,7 +288,7 @@ $vegetal = ($vegetal || isset($gamme) && $gamme && $gamme->slug === "le-vegetal"


@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._routes = {
        "product.show": "{{ route('product.show', $product->slug) }}",
--- a/resources/views/front/recipes/show.blade.php
+++ b/resources/views/front/recipes/show.blade.php
@ -12,7 +12,7 @@ $vegetal = ($recipe->products->first()->range->slug ?? '') == 'le-vegetal';
@section('bg-color', 'white-bg recipeShow')

@section('microdata')
-    <script type="application/ld+json">
+    <script nonce="{{ $nonce }}" type="application/ld+json">
        {
            "@context": "https://schema.org/",
            "@type": "Recipe",
@ -230,7 +230,7 @@ $vegetal = ($recipe->products->first()->range->slug ?? '') == 'le-vegetal';
@endsection

@push('scriptsConstants')
-    <script>
+    <script nonce="{{ $nonce }}">
        window._locale = '{{ app()->getLocale() }}';
        window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
        window._routes = {
--- a/resources/views/front/webldc-cn.blade.php
+++ b/resources/views/front/webldc-cn.blade.php
@ -93,7 +93,8 @@
 </div>

@push('scripts')
-<script>
+<script nonce="{{ $nonce }}">
+document.addEventListener('DOMContentLoaded', () => {
    window.LDCWebCN = new LdcwebCn({
        'recaptcha': {
            'name': "API - reCAPTACHA",
@ -179,5 +180,6 @@
            }
        }
    });
+});
 </script>
@endpush
--- a/resources/views/home.blade.php
+++ b/resources/views/home.blade.php
@ -201,7 +201,7 @@
@endsection

@push('scriptsConstants')
-<script>
+<script nonce="{{ $nonce }}">
    window._translations = @json(cache(sprintf('translations.%s', app()->getLocale())));
    window._routes = {
        "add-single-optin": "{{ route('add-single-optin') }}"
--- a/resources/views/layouts/app-nomenus.blade.php
+++ b/resources/views/layouts/app-nomenus.blade.php
@ -8,7 +8,7 @@
@yield('content')
 </div>
@stack('scriptsConstants')
-<script src="{{ asset('js/preload-main.js') }}"></script>
+<script nonce="{{ $nonce }}" src="{{ asset('js/preload-main.js') }}"></script>
@stack('scripts')
 </body>
 </html>
--- a/resources/views/layouts/app-onepage.blade.php
+++ b/resources/views/layouts/app-onepage.blade.php
@ -18,6 +18,6 @@
        @yield('footer')
    </div>
    @stack('scripts')
-    <script src="{{ mix('js/onepage.js') }}"></script>
+    <script nonce="{{ $nonce }}" src="{{ mix('js/onepage.js') }}"></script>
 </body>
 </html>
--- a/resources/views/layouts/app.blade.php
+++ b/resources/views/layouts/app.blade.php
@ -6,7 +6,7 @@
    @include('front.breadcrumb.breadcrumb-head')
    @yield('microdata')
    @if(config('app.env') === 'local')
-    <script>
+    <script nonce="{{ $nonce }}">
        window.vueDebug = true;
    </script>
    @endif
@ -23,9 +23,9 @@
    @include('front.webldc-cn')
    @include('front.ck-videos')
    @stack('scriptsConstants')
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/js/all.min.js" integrity="sha512-RXf+QSDCUQs5uwRKaDoXt55jygZZm2V++WUZduaU/Ui/9EGp3f/2KZVahFZBKGH0s774sd3HmrhUy+SgOFQLVQ==" crossorigin="anonymous"></script>
-    <script src="{{ mix('js/preload-main.js') }}"></script>
+    <script nonce="{{ $nonce }}" src="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/js/all.min.js" integrity="sha512-RXf+QSDCUQs5uwRKaDoXt55jygZZm2V++WUZduaU/Ui/9EGp3f/2KZVahFZBKGH0s774sd3HmrhUy+SgOFQLVQ==" crossorigin="anonymous"></script>
+    <script nonce="{{ $nonce }}" src="{{ mix('js/preload-main.js') }}"></script>
    @stack('scripts')
 </body>

-</html>
+</html>
--- a/resources/views/layouts/bo.blade.php
+++ b/resources/views/layouts/bo.blade.php
@ -28,7 +28,7 @@
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css" integrity="sha512-iBBXm8fW90+nuLcSKlbmrPcLa0OT92xO1BIsZ+ywDWZCvqsWgccV3gFoRBv0z+8dLJgyAHIhR35VZc2oM/gI1w==" crossorigin="anonymous" />
    @yield('styles')
    @if(config('app.env') === 'local')
-    <script>
+    <script nonce="{{ $nonce }}">
        window.vueDebug = true;
    </script>
    @endif
@ -279,7 +279,7 @@
        </main>
    </div>
    @stack('scriptsConstants')
-    <script>
+    <script nonce="{{ $nonce }}">
        if (!window._routes) {
            window._routes = {};
        }
@ -287,10 +287,10 @@
            "bo.upload": "{{ route('bo.upload') }}"
        };
    </script>
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/js/all.min.js" integrity="sha512-RXf+QSDCUQs5uwRKaDoXt55jygZZm2V++WUZduaU/Ui/9EGp3f/2KZVahFZBKGH0s774sd3HmrhUy+SgOFQLVQ==" crossorigin="anonymous"></script>
-    <script src="{{ asset('js/app.js') }}"></script>
+    <script nonce="{{ $nonce }}" src="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/js/all.min.js" integrity="sha512-RXf+QSDCUQs5uwRKaDoXt55jygZZm2V++WUZduaU/Ui/9EGp3f/2KZVahFZBKGH0s774sd3HmrhUy+SgOFQLVQ==" crossorigin="anonymous"></script>
+    <script nonce="{{ $nonce }}" src="{{ asset('js/app.js') }}"></script>
    @yield('scripts')
    @stack('scripts')
 </body>

-</html>
+</html>
--- a/resources/views/layouts/error-minimal.blade.php
+++ b/resources/views/layouts/error-minimal.blade.php
@ -64,7 +64,7 @@
 </footer>
 </div>
@stack('scriptsConstants')
-<script src="{{ asset('js/main.js') }}"></script>
+<script nonce="{{ $nonce ?? '' }}" src="{{ asset('js/main.js') }}"></script>
@stack('scripts')
 </body>
 </html>
--- a/resources/views/layouts/error.blade.php
+++ b/resources/views/layouts/error.blade.php
@ -23,7 +23,7 @@
@include('layouts.app-footer')
 </div>
@stack('scriptsConstants')
-<script src="{{ asset('js/main.js') }}"></script>
+<script nonce="{{ $nonce ?? '' }}" src="{{ asset('js/main.js') }}"></script>
@stack('scripts')
 </body>
 </html>