From ff3f2c1c9c718cbe4a9099369365db18a38bad22 Mon Sep 17 00:00:00 2001
From: James Cole <thegrumpydictator@gmail.com>
Date: Sat, 4 Jan 2020 11:16:14 +0100
Subject: [PATCH] Code for #2920

---
 resources/views/v1/accounts/create.twig       |  8 ++---
 resources/views/v1/accounts/edit.twig         |  8 ++---
 resources/views/v1/accounts/index.twig        |  2 +-
 .../views/v1/accounts/reconcile/edit.twig     | 16 +++++-----
 resources/views/v1/accounts/show.twig         | 18 ++++++------
 resources/views/v1/admin/link/index.twig      |  2 +-
 resources/views/v1/admin/link/show.twig       |  4 +--
 resources/views/v1/admin/users/index.twig     |  2 +-
 resources/views/v1/attachments/index.twig     |  2 +-
 resources/views/v1/bills/create.twig          |  8 ++---
 resources/views/v1/bills/edit.twig            |  8 ++---
 resources/views/v1/bills/index.twig           |  2 +-
 resources/views/v1/bills/show.twig            | 10 +++----
 resources/views/v1/budgets/create.twig        |  2 +-
 resources/views/v1/budgets/edit.twig          |  2 +-
 resources/views/v1/budgets/index.twig         |  8 ++---
 resources/views/v1/budgets/no-budget.twig     |  2 +-
 resources/views/v1/budgets/show.twig          | 12 ++++----
 resources/views/v1/categories/create.twig     |  2 +-
 resources/views/v1/categories/edit.twig       |  2 +-
 resources/views/v1/categories/index.twig      |  4 +--
 .../views/v1/categories/no-category.twig      |  2 +-
 resources/views/v1/categories/show.twig       | 12 ++++----
 resources/views/v1/form/location.twig         |  2 +-
 .../v1/import/file/configure-upload.twig      |  6 ++--
 .../views/v1/import/spectre/redirect.twig     |  2 +-
 resources/views/v1/import/status.twig         |  4 +--
 resources/views/v1/import/ynab/redirect.twig  |  2 +-
 resources/views/v1/install/index.twig         |  4 +--
 resources/views/v1/layout/empty.twig          | 10 +++----
 resources/views/v1/layout/guest.twig          | 12 ++++----
 resources/views/v1/layout/install.twig        |  6 ++--
 resources/views/v1/partials/empty.twig        |  2 +-
 resources/views/v1/piggy-banks/create.twig    |  6 ++--
 resources/views/v1/piggy-banks/edit.twig      |  6 ++--
 resources/views/v1/piggy-banks/index.twig     |  4 +--
 resources/views/v1/piggy-banks/show.twig      | 10 +++----
 resources/views/v1/preferences/index.twig     |  6 ++--
 resources/views/v1/profile/code.twig          |  2 +-
 resources/views/v1/profile/index.twig         | 29 -------------------
 resources/views/v1/recurring/create.twig      | 16 +++++-----
 resources/views/v1/recurring/edit.twig        | 16 +++++-----
 resources/views/v1/recurring/index.twig       |  2 +-
 resources/views/v1/recurring/show.twig        |  4 +--
 resources/views/v1/reports/audit/report.twig  |  6 ++--
 resources/views/v1/reports/budget/month.twig  | 14 ++++-----
 .../views/v1/reports/category/month.twig      | 14 ++++-----
 resources/views/v1/reports/default/month.twig | 16 +++++-----
 .../views/v1/reports/default/multi-year.twig  | 16 +++++-----
 resources/views/v1/reports/default/year.twig  | 16 +++++-----
 resources/views/v1/reports/double/report.twig | 14 ++++-----
 resources/views/v1/reports/index.twig         |  8 ++---
 resources/views/v1/reports/tag/month.twig     | 14 ++++-----
 resources/views/v1/rules/index.twig           |  4 +--
 .../views/v1/rules/rule-group/create.twig     |  2 +-
 resources/views/v1/rules/rule-group/edit.twig |  2 +-
 .../rules/rule-group/select-transactions.twig |  8 ++---
 resources/views/v1/rules/rule/create.twig     |  6 ++--
 resources/views/v1/rules/rule/edit.twig       |  6 ++--
 .../v1/rules/rule/select-transactions.twig    |  8 ++---
 resources/views/v1/search/index.twig          |  6 ++--
 resources/views/v1/tags/create.twig           | 10 +++----
 resources/views/v1/tags/edit.twig             | 10 +++----
 resources/views/v1/tags/index.twig            |  2 +-
 resources/views/v1/tags/show.twig             |  8 ++---
 .../views/v1/transactions/bulk/edit.twig      | 10 +++----
 resources/views/v1/transactions/convert.twig  |  4 +--
 resources/views/v1/transactions/create.twig   |  2 +-
 resources/views/v1/transactions/edit.twig     |  2 +-
 resources/views/v1/transactions/index.twig    |  2 +-
 .../views/v1/transactions/mass/edit.twig      |  8 ++---
 resources/views/v1/transactions/show.twig     |  6 ++--
 72 files changed, 242 insertions(+), 271 deletions(-)

diff --git a/resources/views/v1/accounts/create.twig b/resources/views/v1/accounts/create.twig
index 8cd242fea7..da1fdc0f28 100644
--- a/resources/views/v1/accounts/create.twig
+++ b/resources/views/v1/accounts/create.twig
@@ -82,10 +82,10 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/accounts/create.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/accounts/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/accounts/edit.twig b/resources/views/v1/accounts/edit.twig
index b8740d710c..936edd1099 100644
--- a/resources/views/v1/accounts/edit.twig
+++ b/resources/views/v1/accounts/edit.twig
@@ -105,10 +105,10 @@
     {{ Form.close|raw }}
 {% endblock %}
 {% block scripts %}
-    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/accounts/edit.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/accounts/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/accounts/index.twig b/resources/views/v1/accounts/index.twig
index c6c303eb28..553f4dee9e 100644
--- a/resources/views/v1/accounts/index.twig
+++ b/resources/views/v1/accounts/index.twig
@@ -78,5 +78,5 @@
     <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var objectType = '{{ objectType|escape }}';
     </script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/accounts/reconcile/edit.twig b/resources/views/v1/accounts/reconcile/edit.twig
index 65bd5578b5..9a02947a4d 100644
--- a/resources/views/v1/accounts/reconcile/edit.twig
+++ b/resources/views/v1/accounts/reconcile/edit.twig
@@ -96,18 +96,18 @@
     <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var what = "{{ what }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/jscript/accounts?ext=.js&amp;v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/jscript/currencies?ext=.js&amp;v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/jscript/accounts?ext=.js&amp;v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/jscript/currencies?ext=.js&amp;v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     <script type="text/javascript">
         var journal = {{ journal.toArray()|json_encode|raw }};
         var journalData = {{ data|json_encode|raw }};
     </script>
-    <script type="text/javascript" src="v1/js/ff/accounts/edit-reconciliation.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/accounts/edit-reconciliation.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 {% block styles %}
     <link href="v1/css/bootstrap-tagsinput.css?v={{ FF_VERSION }}" type="text/css" rel="stylesheet" media="all">
diff --git a/resources/views/v1/accounts/show.twig b/resources/views/v1/accounts/show.twig
index 4f17701d8e..8a16f6d0da 100644
--- a/resources/views/v1/accounts/show.twig
+++ b/resources/views/v1/accounts/show.twig
@@ -191,18 +191,18 @@
 
     </script>
     {% if location %}
-        <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
+        <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     {% endif %}
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/chartjs-plugin-annotation.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/chartjs-plugin-annotation.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
-    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript"></script>
-    <script src="v1/js/lib/jquery.color-2.1.2.min.js?v={{ FF_VERSION }}" type="text/javascript"></script>
-    <script src="v1/js/ff/accounts/show.js?v={{ FF_VERSION }}" type="text/javascript"></script>
+    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/lib/jquery.color-2.1.2.min.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/ff/accounts/show.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/admin/link/index.twig b/resources/views/v1/admin/link/index.twig
index 9ce2ad64a2..821c49b3de 100644
--- a/resources/views/v1/admin/link/index.twig
+++ b/resources/views/v1/admin/link/index.twig
@@ -60,7 +60,7 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/admin/link/show.twig b/resources/views/v1/admin/link/show.twig
index 2ee0195f0b..8a807af761 100644
--- a/resources/views/v1/admin/link/show.twig
+++ b/resources/views/v1/admin/link/show.twig
@@ -57,9 +57,9 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
-    <link rel="stylesheet" href="v1//bootstrap-sortable.css?v={{ FF_VERSION }}" type="text/css" media="all"/>
+    <link rel="stylesheet" href="v1/css/bootstrap-sortable.css?v={{ FF_VERSION }}" type="text/css" media="all"/>
 {% endblock %}
diff --git a/resources/views/v1/admin/users/index.twig b/resources/views/v1/admin/users/index.twig
index 7742e9f4e8..704cc77a1a 100644
--- a/resources/views/v1/admin/users/index.twig
+++ b/resources/views/v1/admin/users/index.twig
@@ -89,5 +89,5 @@
     <link rel="stylesheet" href="v1/css/bootstrap-sortable.css?v={{ FF_VERSION }}" type="text/css" media="all"/>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/attachments/index.twig b/resources/views/v1/attachments/index.twig
index 146cba5983..fd78e78a81 100644
--- a/resources/views/v1/attachments/index.twig
+++ b/resources/views/v1/attachments/index.twig
@@ -68,7 +68,7 @@
     </div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/bills/create.twig b/resources/views/v1/bills/create.twig
index 8d1e69ff90..bc299a9c54 100644
--- a/resources/views/v1/bills/create.twig
+++ b/resources/views/v1/bills/create.twig
@@ -65,8 +65,8 @@
     <link href="v1/css/jquery-ui/jquery-ui.theme.min.css?v={{ FF_VERSION }}" type="text/css" rel="stylesheet" media="all">
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/bills/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/bills/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/bills/edit.twig b/resources/views/v1/bills/edit.twig
index 509e26704c..a1bdb1a002 100644
--- a/resources/views/v1/bills/edit.twig
+++ b/resources/views/v1/bills/edit.twig
@@ -66,8 +66,8 @@
     <link href="v1/css/jquery-ui/jquery-ui.theme.min.css?v={{ FF_VERSION }}" type="text/css" rel="stylesheet" media="all">
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/accounts/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/accounts/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/bills/index.twig b/resources/views/v1/bills/index.twig
index 286d18c865..475ada6b5f 100644
--- a/resources/views/v1/bills/index.twig
+++ b/resources/views/v1/bills/index.twig
@@ -46,5 +46,5 @@
         var start = '2018-01-01';
         var end = '2018-01-31';
     </script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/bills/show.twig b/resources/views/v1/bills/show.twig
index 1aecda481c..e4a560f086 100644
--- a/resources/views/v1/bills/show.twig
+++ b/resources/views/v1/bills/show.twig
@@ -181,10 +181,10 @@
         var billCurrencySymbol = "{{ object.data.currency.symbol }}";
         var billUri = '{{ route('chart.bill.single', [object.data.id]) }}';
     </script>
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/bills/show.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/bills/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/budgets/create.twig b/resources/views/v1/budgets/create.twig
index bfc7c3dca6..52966dd290 100644
--- a/resources/views/v1/budgets/create.twig
+++ b/resources/views/v1/budgets/create.twig
@@ -43,5 +43,5 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/budgets/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/budgets/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/budgets/edit.twig b/resources/views/v1/budgets/edit.twig
index 7e17274c58..f8c277b8a3 100644
--- a/resources/views/v1/budgets/edit.twig
+++ b/resources/views/v1/budgets/edit.twig
@@ -41,5 +41,5 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/budgets/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/budgets/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/budgets/index.twig b/resources/views/v1/budgets/index.twig
index 8d34f9736a..549b6b9bf4 100644
--- a/resources/views/v1/budgets/index.twig
+++ b/resources/views/v1/budgets/index.twig
@@ -408,8 +408,8 @@
 {% endblock %}
 
 {% block scripts %}
-    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript"></script>
-    <script type="text/javascript">
+    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var budgetIndexUri = "{{ route('budgets.index',['START','END']) }}";
         var createAvailableBudgetUri = "{{ route('available-budgets.create', [start.format('Y-m-d'), end.format('Y-m-d')]) }}";
         var createAltAvailableBudgetUri = "{{ route('available-budgets.create-alternative', [start.format('Y-m-d'), end.format('Y-m-d')]) }}";
@@ -424,6 +424,6 @@
         var periodStart = "{{ start.format('Y-m-d') }}";
         var periodEnd = "{{ end.format('Y-m-d') }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/budgets/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/budgets/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/budgets/no-budget.twig b/resources/views/v1/budgets/no-budget.twig
index 4d0dcaec47..498d7b2458 100644
--- a/resources/views/v1/budgets/no-budget.twig
+++ b/resources/views/v1/budgets/no-budget.twig
@@ -60,5 +60,5 @@
 {% endblock %}
 {% block scripts %}
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/budgets/show.twig b/resources/views/v1/budgets/show.twig
index 44100805fd..37657d7435 100644
--- a/resources/views/v1/budgets/show.twig
+++ b/resources/views/v1/budgets/show.twig
@@ -189,7 +189,7 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var budgetID = {{ budget.id }};
         var budgetLimitID = 0;
         {% if budgetLimit.id %}
@@ -207,10 +207,10 @@
         {% endif %}
     </script>
 
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/budgets/show.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/budgets/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/categories/create.twig b/resources/views/v1/categories/create.twig
index fe7d881502..4c969aabf2 100644
--- a/resources/views/v1/categories/create.twig
+++ b/resources/views/v1/categories/create.twig
@@ -41,5 +41,5 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/budgets/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/budgets/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/categories/edit.twig b/resources/views/v1/categories/edit.twig
index dfc1949bcb..f308b77853 100644
--- a/resources/views/v1/categories/edit.twig
+++ b/resources/views/v1/categories/edit.twig
@@ -41,5 +41,5 @@
     {{ Form.close|raw }}
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/categories/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/categories/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/categories/index.twig b/resources/views/v1/categories/index.twig
index b740f78062..4754267898 100644
--- a/resources/views/v1/categories/index.twig
+++ b/resources/views/v1/categories/index.twig
@@ -44,6 +44,6 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/categories/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/categories/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/categories/no-category.twig b/resources/views/v1/categories/no-category.twig
index c43b254ddf..0553cf1331 100644
--- a/resources/views/v1/categories/no-category.twig
+++ b/resources/views/v1/categories/no-category.twig
@@ -60,5 +60,5 @@
 {% endblock %}
 {% block scripts %}
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/categories/show.twig b/resources/views/v1/categories/show.twig
index 09c50649e6..669b5d21bc 100644
--- a/resources/views/v1/categories/show.twig
+++ b/resources/views/v1/categories/show.twig
@@ -94,15 +94,15 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var current = '{{ route('chart.category.current', [category.id]) }}';
         var everything = '{{ route('chart.category.all', [category.id]) }}';
         var specific = '{{ route('chart.category.specific', [category.id, start.format('Ymd')]) }}';
     </script>
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/categories/show.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/categories/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/form/location.twig b/resources/views/v1/form/location.twig
index 8df6d7273a..625c144a35 100644
--- a/resources/views/v1/form/location.twig
+++ b/resources/views/v1/form/location.twig
@@ -51,7 +51,7 @@
     {% set haslocationvar = name~'_has_location' %}
     {% set clearvar = name~'_clear_location' %}
 
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var mymap;
         var marker;
         if (typeof locations.{{ name }}.latitude === 'undefined') {
diff --git a/resources/views/v1/import/file/configure-upload.twig b/resources/views/v1/import/file/configure-upload.twig
index 1f41fa62e0..22df3a621f 100644
--- a/resources/views/v1/import/file/configure-upload.twig
+++ b/resources/views/v1/import/file/configure-upload.twig
@@ -106,13 +106,13 @@
     <link href="v1/css/bootstrap-multiselect.css?v={{ FF_VERSION }}" rel="stylesheet" type="text/css"/>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var selectAllText = "{{ trans('firefly.multi_select_select_all')|escape('js') }}";
         var nonSelectedText = "{{ trans('firefly.multi_select_no_selection')|escape('js') }}";
         var nSelectedText = "{{ trans('firefly.multi_select_n_selected')|escape('js') }}";
         var allSelectedText = "{{ trans('firefly.multi_select_all_selected')|escape('js') }}";
         var filterPlaceholder = "{{ trans('firefly.multi_select_filter_placeholder')|escape('js') }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-multiselect.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/import/file/configure-upload.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-multiselect.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/import/file/configure-upload.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/import/spectre/redirect.twig b/resources/views/v1/import/spectre/redirect.twig
index 84d4547cad..22c838e691 100644
--- a/resources/views/v1/import/spectre/redirect.twig
+++ b/resources/views/v1/import/spectre/redirect.twig
@@ -3,7 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta http-equiv="refresh" content="0; url={{ data['token-url'] }}">
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         window.location.href = "{{ data['token-url'] }}";
     </script>
     <title>Page Redirection</title>
diff --git a/resources/views/v1/import/status.twig b/resources/views/v1/import/status.twig
index ae0b27095d..7c9b0fbf91 100644
--- a/resources/views/v1/import/status.twig
+++ b/resources/views/v1/import/status.twig
@@ -171,7 +171,7 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var jobStatusUri = '{{ route('import.job.status.json', [importJob.key]) }}';
         var jobStartUri = '{{ route('import.job.start', [importJob.key]) }}';
         var jobConfigurationUri = '{{ route('import.job.configuration.index', [importJob.key]) }}';
@@ -190,7 +190,7 @@
         var token = '{{ csrf_token() }}';
         var job = {{ job|json_encode|raw }};
     </script>
-    <script type="text/javascript" src="v1/js/ff/import/status_v2.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/import/status_v2.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 {% block styles %}
 {% endblock %}
diff --git a/resources/views/v1/import/ynab/redirect.twig b/resources/views/v1/import/ynab/redirect.twig
index a0bf532a0c..f241a7aa22 100644
--- a/resources/views/v1/import/ynab/redirect.twig
+++ b/resources/views/v1/import/ynab/redirect.twig
@@ -3,7 +3,7 @@
 <head>
     <meta charset="UTF-8">
     <meta http-equiv="refresh" content="0; url={{ data['token-url'] }}">
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         window.location.href = "{{ data['token-url'] }}";
     </script>
     <title>Page Redirection</title>
diff --git a/resources/views/v1/install/index.twig b/resources/views/v1/install/index.twig
index 9fa73d1d54..81ad452bad 100644
--- a/resources/views/v1/install/index.twig
+++ b/resources/views/v1/install/index.twig
@@ -13,12 +13,12 @@
     </div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var token = '{{ csrf_token() }}';
         var index = 0;
         var runCommandUri = '{{ route('installer.runCommand') }}';
         var homeUri = '{{ route('flush') }}';
     </script>
-    <script type="text/javascript" src="v1/js/ff/install/index.js"></script>
+    <script type="text/javascript" src="v1/js/ff/install/index.js" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
diff --git a/resources/views/v1/layout/empty.twig b/resources/views/v1/layout/empty.twig
index 72d25ea687..9e98de6cb1 100644
--- a/resources/views/v1/layout/empty.twig
+++ b/resources/views/v1/layout/empty.twig
@@ -25,8 +25,8 @@
     <link href="v1/css/firefly.css?v={{ FF_VERSION }}" rel="stylesheet" type="text/css"/>
 
     <!--[if lt IE 9]>
-    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     <![endif]-->
 
     {# favicons #}
@@ -41,13 +41,13 @@
     {% block content %}{% endblock %}
 </div>
 
-<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript"></script>
+<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
 {% if config('firefly.analytics_id')  != '' %}
     <!-- Global site tag (gtag.js) - Google Analytics -->
     <!-- This tag is only here because this instance of Firefly III was purposefully configured to include it -->
     <!-- Your own installation will NOT include it -->
-    <script async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id')  }}"></script>
-    <script>
+    <script async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id')  }}" nonce="{{ JS_NONCE }}"></script>
+    <script nonce="{{ JS_NONCE }}">
         window.dataLayer = window.dataLayer || [];
         function gtag(){dataLayer.push(arguments);}
         gtag('js', new Date());
diff --git a/resources/views/v1/layout/guest.twig b/resources/views/v1/layout/guest.twig
index 3a0f3f0558..4aadb107d5 100644
--- a/resources/views/v1/layout/guest.twig
+++ b/resources/views/v1/layout/guest.twig
@@ -35,8 +35,8 @@
     <link href="v1/css/firefly.css?v={{ FF_VERSION }}" rel="stylesheet" type="text/css"/>
 
     <!--[if lt IE 9]>
-    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     <![endif]-->
 
     {# favicons #}
@@ -55,14 +55,14 @@
         Developed by James Cole, the source code is licensed under the <a href="https://www.gnu.org/licenses/agpl-3.0.html">AGPL-3.0-or-later</a>.
     </small>
 </div>
-<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript"></script>
-<script type="text/javascript" src="v1/js/ff/guest.js?v={{ FF_VERSION }}"></script>
+<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
+<script type="text/javascript" src="v1/js/ff/guest.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% if config('firefly.analytics_id')  != '' %}
     <!-- Global site tag (gtag.js) - Google Analytics -->
     <!-- This tag is only here because this instance of Firefly III was purposefully configured to include it -->
     <!-- Your own installation will NOT include it -->
-    <script async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id')  }}"></script>
-    <script>
+    <script async src="https://www.googletagmanager.com/gtag/js?id={{ config('firefly.analytics_id')  }}" nonce="{{ JS_NONCE }}"></script>
+    <script nonce="{{ JS_NONCE }}">
         window.dataLayer = window.dataLayer || [];
         function gtag(){dataLayer.push(arguments);}
         gtag('js', new Date());
diff --git a/resources/views/v1/layout/install.twig b/resources/views/v1/layout/install.twig
index a5ac31db7a..075cf0ca4d 100644
--- a/resources/views/v1/layout/install.twig
+++ b/resources/views/v1/layout/install.twig
@@ -18,8 +18,8 @@
     <link href="v1/css/firefly.css?v={{ FF_VERSION }}" rel="stylesheet" type="text/css"/>
 
     <!--[if lt IE 9]>
-    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/js/lib/html5shiv.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/lib/respond.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     <![endif]-->
 
     {# favicons #}
@@ -34,7 +34,7 @@
     </div>
     {% block content %}{% endblock %}
 </div>
-<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript"></script>
+<script src="v1/js/app.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
 {% block scripts %}{% endblock %}
 </body>
 </html>
diff --git a/resources/views/v1/partials/empty.twig b/resources/views/v1/partials/empty.twig
index 679c239c9b..46b09052a6 100644
--- a/resources/views/v1/partials/empty.twig
+++ b/resources/views/v1/partials/empty.twig
@@ -21,6 +21,6 @@
         </div>
     </div>
 </div>
-<script type="text/javascript">
+<script type="text/javascript" nonce="{{ JS_NONCE }}">
     forceDemoOff = true;
 </script>
diff --git a/resources/views/v1/piggy-banks/create.twig b/resources/views/v1/piggy-banks/create.twig
index db388cbeb0..06d3d5a181 100644
--- a/resources/views/v1/piggy-banks/create.twig
+++ b/resources/views/v1/piggy-banks/create.twig
@@ -55,9 +55,9 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/piggy-banks/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/piggy-banks/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/piggy-banks/edit.twig b/resources/views/v1/piggy-banks/edit.twig
index c6b0d19a81..668d1441a9 100644
--- a/resources/views/v1/piggy-banks/edit.twig
+++ b/resources/views/v1/piggy-banks/edit.twig
@@ -58,9 +58,9 @@
     {{ Form.close|raw }}
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/piggy-banks/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/piggy-banks/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/piggy-banks/index.twig b/resources/views/v1/piggy-banks/index.twig
index 4065a705e5..113e2a2cda 100644
--- a/resources/views/v1/piggy-banks/index.twig
+++ b/resources/views/v1/piggy-banks/index.twig
@@ -75,6 +75,6 @@
 {% endif %}
 {% endblock %}
 {% block scripts %}
-    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript"></script>
-    <script type="text/javascript" src="v1/js/ff/piggy-banks/index.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" type="text/javascript" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/piggy-banks/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/piggy-banks/show.twig b/resources/views/v1/piggy-banks/show.twig
index efe033ba97..192e11bab8 100644
--- a/resources/views/v1/piggy-banks/show.twig
+++ b/resources/views/v1/piggy-banks/show.twig
@@ -117,12 +117,12 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var piggyBankID = {{ piggyBank.id }};
     </script>
 
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/piggy-banks/show.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/piggy-banks/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/preferences/index.twig b/resources/views/v1/preferences/index.twig
index 03eb70ff35..258306b7d3 100644
--- a/resources/views/v1/preferences/index.twig
+++ b/resources/views/v1/preferences/index.twig
@@ -204,9 +204,9 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/preferences/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/preferences/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/profile/code.twig b/resources/views/v1/profile/code.twig
index da17e20b06..17eac7e1b2 100644
--- a/resources/views/v1/profile/code.twig
+++ b/resources/views/v1/profile/code.twig
@@ -49,7 +49,7 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         $(function () {
             "use strict";
 
diff --git a/resources/views/v1/profile/index.twig b/resources/views/v1/profile/index.twig
index bacebd21dc..2e8a109d9f 100644
--- a/resources/views/v1/profile/index.twig
+++ b/resources/views/v1/profile/index.twig
@@ -132,33 +132,4 @@
     <div id="passport_clients"></div>
 {% endblock %}
 {% block scripts %}
-    {% if SANDSTORM %}
-        <script>
-            function requestIframeURL() {
-                var template = "You can use the $API_TOKEN key to reach Firefly III at $API_HOST.";
-                window.parent.postMessage({
-                                              renderTemplate: {
-                                                  rpcId: "0",
-                                                  template: template,
-                                                  clipboardButton: 'left'
-                                              }
-                                          }, "*");
-            }
-
-            document.addEventListener("DOMContentLoaded", requestIframeURL);
-
-            var copyIframeURLToElement = function (event) {
-                if (event.data.rpcId === "0") {
-                    if (event.data.error) {
-                        console.log("ERROR: " + event.data.error);
-                    } else {
-                        var el = document.getElementById("offer-iframe");
-                        el.setAttribute("src", event.data.uri);
-                    }
-                }
-            };
-
-            window.addEventListener("message", copyIframeURLToElement);
-        </script>
-    {% endif %}
 {% endblock %}
diff --git a/resources/views/v1/recurring/create.twig b/resources/views/v1/recurring/create.twig
index 3aa50df483..a02f0239d8 100644
--- a/resources/views/v1/recurring/create.twig
+++ b/resources/views/v1/recurring/create.twig
@@ -197,19 +197,19 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/lib/fc/fullcalendar.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/lib/fc/fullcalendar.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var transactionType = "{{ preFilled.transaction_type }}";
         var suggestUri = "{{ route('recurring.suggest') }}";
         var eventsUri = "{{ route('recurring.events') }}";
         var oldRepetitionType= "{{ oldRepetitionType }}";
     </script>
-    <script type="text/javascript" src="v1/js/ff/recurring/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/recurring/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/recurring/edit.twig b/resources/views/v1/recurring/edit.twig
index 0b466d4d8b..d06bf5e523 100644
--- a/resources/views/v1/recurring/edit.twig
+++ b/resources/views/v1/recurring/edit.twig
@@ -193,19 +193,19 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/lib/fc/fullcalendar.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/lib/fc/fullcalendar.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var transactionType = "{{ preFilled.transaction_type }}";
         var suggestUri = "{{ route('recurring.suggest') }}";
         var eventsUri = "{{ route('recurring.events') }}";
         var currentRepType = "{{ currentRepType }}";
     </script>
-    <script type="text/javascript" src="v1/js/ff/recurring/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/recurring/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/recurring/index.twig b/resources/views/v1/recurring/index.twig
index 5d8ad31b4f..98f53febe2 100644
--- a/resources/views/v1/recurring/index.twig
+++ b/resources/views/v1/recurring/index.twig
@@ -152,5 +152,5 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/recurring/show.twig b/resources/views/v1/recurring/show.twig
index c60c054988..f0c97dd750 100644
--- a/resources/views/v1/recurring/show.twig
+++ b/resources/views/v1/recurring/show.twig
@@ -175,7 +175,7 @@
     {% endblock %}
 
     {% block scripts %}
-        <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+        <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
         {# required for groups.twig #}
-        <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+        <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
     {% endblock %}
diff --git a/resources/views/v1/reports/audit/report.twig b/resources/views/v1/reports/audit/report.twig
index bbd5a372c2..4fb49d6313 100644
--- a/resources/views/v1/reports/audit/report.twig
+++ b/resources/views/v1/reports/audit/report.twig
@@ -84,9 +84,9 @@
 {% block styles %}
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var hideable = {{ hideable|json_encode|raw }};
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/audit/all.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/audit/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/reports/budget/month.twig b/resources/views/v1/reports/budget/month.twig
index aed5bea2b5..1b2537fad1 100644
--- a/resources/views/v1/reports/budget/month.twig
+++ b/resources/views/v1/reports/budget/month.twig
@@ -149,12 +149,12 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // to report another URL:
         var startDate = '{{ start.format('Ymd') }}';
         var endDate = '{{ end.format('Ymd') }}';
@@ -176,8 +176,8 @@
     </script>
 
 
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/budget/month.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/budget/month.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 
diff --git a/resources/views/v1/reports/category/month.twig b/resources/views/v1/reports/category/month.twig
index 3f160fa958..eb7b04b868 100644
--- a/resources/views/v1/reports/category/month.twig
+++ b/resources/views/v1/reports/category/month.twig
@@ -214,13 +214,13 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // to report another URL:
         var startDate = '{{ start.format('Ymd') }}';
         var endDate = '{{ end.format('Ymd') }}';
@@ -248,7 +248,7 @@
         var topIncomeUri = '{{ route('report-data.category.top-income', [accountIds, categoryIds, start.format('Ymd'), end.format('Ymd')]) }}';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/category/month.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/category/month.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 
diff --git a/resources/views/v1/reports/default/month.twig b/resources/views/v1/reports/default/month.twig
index d3d9a5a16d..51de27277b 100644
--- a/resources/views/v1/reports/default/month.twig
+++ b/resources/views/v1/reports/default/month.twig
@@ -147,11 +147,11 @@
 {% endblock %}
 {% block scripts %}
 
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var year = {{ start.year }};
         var month = {{ start.month }};
 
@@ -175,7 +175,7 @@
         var accountChartUri = '{{ route('chart.account.report', [accountIds, start.format('Ymd'), end.format('Ymd')]) }}';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/month.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/month.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/reports/default/multi-year.twig b/resources/views/v1/reports/default/multi-year.twig
index f8d6adf47e..760e3e4b1d 100644
--- a/resources/views/v1/reports/default/multi-year.twig
+++ b/resources/views/v1/reports/default/multi-year.twig
@@ -189,11 +189,11 @@
 {% endblock %}
 {% block scripts %}
 
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var year = {{ start.year }};
         var month = {{ start.month }};
 
@@ -218,7 +218,7 @@
         var billReportUri = '';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/multi-year.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/multi-year.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/reports/default/year.twig b/resources/views/v1/reports/default/year.twig
index 1c4bb2a288..cd44bc6d77 100644
--- a/resources/views/v1/reports/default/year.twig
+++ b/resources/views/v1/reports/default/year.twig
@@ -184,11 +184,11 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var year = '{{ start.year }}';
 
         // to report another URL:
@@ -212,9 +212,9 @@
         var billReportUri = '';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/default/year.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/default/year.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 {% block styles %}
diff --git a/resources/views/v1/reports/double/report.twig b/resources/views/v1/reports/double/report.twig
index 3b07f39b15..a9ce539098 100644
--- a/resources/views/v1/reports/double/report.twig
+++ b/resources/views/v1/reports/double/report.twig
@@ -192,12 +192,12 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // to report another URL:
         var startDate = '{{ start.format('Ymd') }}';
         var endDate = '{{ end.format('Ymd') }}';
@@ -224,8 +224,8 @@
         var topIncomeUri = '{{ route('report-data.double.top-income', [accountIds, doubleIds, start.format('Ymd'), end.format('Ymd')]) }}';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/double/month.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/double/month.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 
diff --git a/resources/views/v1/reports/index.twig b/resources/views/v1/reports/index.twig
index a7347a73d5..9870c11682 100644
--- a/resources/views/v1/reports/index.twig
+++ b/resources/views/v1/reports/index.twig
@@ -176,7 +176,7 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var minDate = "{{ start.format('Y-m-d') }}";
         var picker;
         var selectAllText = "{{ trans('firefly.multi_select_select_all')|escape('js') }}";
@@ -185,7 +185,7 @@
         var allSelectedText = "{{ trans('firefly.multi_select_all_selected')|escape('js')   }}";
         var filterPlaceholder = "{{ trans('firefly.multi_select_filter_placeholder')|escape('js') }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-multiselect.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/reports/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-multiselect.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/reports/tag/month.twig b/resources/views/v1/reports/tag/month.twig
index 96f08ccd34..5ed152ee39 100644
--- a/resources/views/v1/reports/tag/month.twig
+++ b/resources/views/v1/reports/tag/month.twig
@@ -245,13 +245,13 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/Chart.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.defaults.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/charts.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-sortable.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
-    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/ff/reports/all.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // to report another URL:
         var startDate = '{{ start.format('Ymd') }}';
         var endDate = '{{ end.format('Ymd') }}';
@@ -281,7 +281,7 @@
         var topIncomeUri = '{{ route('report-data.tag.top-income', [accountIds, tagIds, start.format('Ymd'), end.format('Ymd')]) }}';
 
     </script>
-    <script type="text/javascript" src="v1/js/ff/reports/tag/month.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/reports/tag/month.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 
diff --git a/resources/views/v1/rules/index.twig b/resources/views/v1/rules/index.twig
index 01df15ee5c..ba52eaa5a6 100644
--- a/resources/views/v1/rules/index.twig
+++ b/resources/views/v1/rules/index.twig
@@ -203,6 +203,6 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/rules/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rules/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/rules/rule-group/create.twig b/resources/views/v1/rules/rule-group/create.twig
index 69aacce284..8873384298 100644
--- a/resources/views/v1/rules/rule-group/create.twig
+++ b/resources/views/v1/rules/rule-group/create.twig
@@ -49,5 +49,5 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/rule-groups/create.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rule-groups/create.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/rules/rule-group/edit.twig b/resources/views/v1/rules/rule-group/edit.twig
index 18001e4366..3071059ef6 100644
--- a/resources/views/v1/rules/rule-group/edit.twig
+++ b/resources/views/v1/rules/rule-group/edit.twig
@@ -53,5 +53,5 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/ff/rule-groups/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rule-groups/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/rules/rule-group/select-transactions.twig b/resources/views/v1/rules/rule-group/select-transactions.twig
index 7d885c6258..a526591cdc 100644
--- a/resources/views/v1/rules/rule-group/select-transactions.twig
+++ b/resources/views/v1/rules/rule-group/select-transactions.twig
@@ -42,12 +42,12 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var askReadWarning = "{{ trans('firefly.rules_have_read_warning')|escape('js') }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/rules/select-transactions.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rules/select-transactions.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/rules/rule/create.twig b/resources/views/v1/rules/rule/create.twig
index 8a9bc42327..3d9373c2c9 100644
--- a/resources/views/v1/rules/rule/create.twig
+++ b/resources/views/v1/rules/rule/create.twig
@@ -145,13 +145,13 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var triggerCount = {{ triggerCount }};
         var actionCount = {{ actionCount }};
         var testRuleTriggersText = '{{ 'test_rule_triggers'|_|escape('js') }}';
     </script>
-    <script type="text/javascript" src="v1/js/ff/rules/create-edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rules/create-edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
 {% block styles %}
diff --git a/resources/views/v1/rules/rule/edit.twig b/resources/views/v1/rules/rule/edit.twig
index 31fe3dddfd..039697de70 100644
--- a/resources/views/v1/rules/rule/edit.twig
+++ b/resources/views/v1/rules/rule/edit.twig
@@ -128,12 +128,12 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var triggerCount = {{ triggerCount }};
         var actionCount = {{ actionCount }};
         var testRuleTriggersText = '{{ 'test_rule_triggers'|_|escape('js') }}';
     </script>
-    <script type="text/javascript" src="v1/js/ff/rules/create-edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rules/create-edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
diff --git a/resources/views/v1/rules/rule/select-transactions.twig b/resources/views/v1/rules/rule/select-transactions.twig
index 6c9555d1a4..5f70ec45c2 100644
--- a/resources/views/v1/rules/rule/select-transactions.twig
+++ b/resources/views/v1/rules/rule/select-transactions.twig
@@ -42,12 +42,12 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var askReadWarning = "{{ trans('firefly.rules_have_read_warning')|escape('js') }}";
     </script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/rules/select-transactions.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/rules/select-transactions.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 
 {% block styles %}
diff --git a/resources/views/v1/search/index.twig b/resources/views/v1/search/index.twig
index b4afc13d83..9593b0f272 100644
--- a/resources/views/v1/search/index.twig
+++ b/resources/views/v1/search/index.twig
@@ -115,7 +115,7 @@
     {% endif %}
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var edit_selected_txt = "{{ trans('firefly.edit')|escape('js') }}";
         var delete_selected_txt = "{{ trans('firefly.delete')|escape('js') }}";
         var edit_bulk_selected_txt = "{{ trans('firefly.bulk_edit')|escape('js') }}";
@@ -125,7 +125,7 @@
         var searchPage = {{ page }};
     </script>
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/search/index.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/search/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 
 {% endblock %}
diff --git a/resources/views/v1/tags/create.twig b/resources/views/v1/tags/create.twig
index c47a3a28d0..e53abf4d9f 100644
--- a/resources/views/v1/tags/create.twig
+++ b/resources/views/v1/tags/create.twig
@@ -6,7 +6,7 @@
 
 {% block content %}
     <!-- set location data high up -->
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var locations = {{ locations|json_encode|raw }};
         var mapboxToken = "{{ config('firefly.mapbox_api_key') }}";
     </script>
@@ -57,10 +57,10 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/ff/tags/create-edit.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/ff/tags/create-edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 {% block styles %}
     <link rel="stylesheet" href="v1/lib/leaflet/leaflet.css?v={{ FF_VERSION }}"/>
diff --git a/resources/views/v1/tags/edit.twig b/resources/views/v1/tags/edit.twig
index fba7a76b80..1c7a6b1819 100644
--- a/resources/views/v1/tags/edit.twig
+++ b/resources/views/v1/tags/edit.twig
@@ -6,7 +6,7 @@
 
 {% block content %}
     <!-- set location data high up -->
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var locations = {{ locations|json_encode|raw }};
         var mapboxToken = "{{ config('firefly.mapbox_api_key') }}";
     </script>
@@ -62,10 +62,10 @@
 
 {% endblock %}
 {% block scripts %}
-    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/ff/tags/create-edit.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/modernizr-custom.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/jquery-ui.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/ff/tags/create-edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 {% block styles %}
     <link rel="stylesheet" href="v1/lib/leaflet/leaflet.css?v={{ FF_VERSION }}"/>
diff --git a/resources/views/v1/tags/index.twig b/resources/views/v1/tags/index.twig
index 000b48c6d7..8bcd5fa0da 100644
--- a/resources/views/v1/tags/index.twig
+++ b/resources/views/v1/tags/index.twig
@@ -62,5 +62,5 @@
 
 {% endblock %}
 {% block scripts %}
-    <script src="v1/js/ff/tags/index.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/js/ff/tags/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/tags/show.twig b/resources/views/v1/tags/show.twig
index 3aebafdec7..7c37470c40 100644
--- a/resources/views/v1/tags/show.twig
+++ b/resources/views/v1/tags/show.twig
@@ -177,7 +177,7 @@
     <link rel="stylesheet" href="v1/lib/leaflet/leaflet.css?v={{ FF_VERSION }}"/>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // location stuff
         {% if location %}
             var latitude = {{ location.latitude|default("52.3167") }};
@@ -188,7 +188,7 @@
             var mapboxToken = "{{ config('firefly.mapbox_api_key') }}";
         {% endif %}
     </script>
-    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}"></script>
-    <script src="v1/js/ff/tags/show.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script src="v1/lib/leaflet/leaflet.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script src="v1/js/ff/tags/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/transactions/bulk/edit.twig b/resources/views/v1/transactions/bulk/edit.twig
index bff7dbf877..d3eecd86ec 100644
--- a/resources/views/v1/transactions/bulk/edit.twig
+++ b/resources/views/v1/transactions/bulk/edit.twig
@@ -172,13 +172,13 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var what = "";
     </script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/transactions/mass/edit-bulk.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/lib/bootstrap-tagsinput.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/transactions/mass/edit-bulk.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
 {% block styles %}
     <link href="v1/css/bootstrap-tagsinput.css?v={{ FF_VERSION }}" type="text/css" rel="stylesheet" media="all">
diff --git a/resources/views/v1/transactions/convert.twig b/resources/views/v1/transactions/convert.twig
index c5e691a581..f798d95c14 100644
--- a/resources/views/v1/transactions/convert.twig
+++ b/resources/views/v1/transactions/convert.twig
@@ -274,6 +274,6 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/transactions/convert.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/transactions/convert.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/transactions/create.twig b/resources/views/v1/transactions/create.twig
index 276b55a0e4..44056f1f98 100644
--- a/resources/views/v1/transactions/create.twig
+++ b/resources/views/v1/transactions/create.twig
@@ -8,7 +8,7 @@
     <div id="create_transaction"></div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var allowedOpposingTypes = {{ allowedOpposingTypes|json_encode|raw }};
         var accountToTypes = {{ accountToTypes|json_encode|raw }};
         var defaultCurrency = {{ defaultCurrency.toArray()|json_encode|raw }};
diff --git a/resources/views/v1/transactions/edit.twig b/resources/views/v1/transactions/edit.twig
index 219b59f673..7cd0c054e9 100644
--- a/resources/views/v1/transactions/edit.twig
+++ b/resources/views/v1/transactions/edit.twig
@@ -8,7 +8,7 @@
     <div id="edit_transaction"></div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var allowedOpposingTypes = {{ allowedOpposingTypes|json_encode|raw }};
         var accountToTypes = {{ accountToTypes|json_encode|raw }};
         var defaultCurrency = {{ defaultCurrency.toArray()|json_encode|raw }};
diff --git a/resources/views/v1/transactions/index.twig b/resources/views/v1/transactions/index.twig
index 7fe398a107..5a45763663 100644
--- a/resources/views/v1/transactions/index.twig
+++ b/resources/views/v1/transactions/index.twig
@@ -67,5 +67,5 @@
 {% endblock %}
 {% block scripts %}
     {# required for groups.twig #}
-    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/ff/list/groups.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/transactions/mass/edit.twig b/resources/views/v1/transactions/mass/edit.twig
index e9039cbe8c..f822a71084 100644
--- a/resources/views/v1/transactions/mass/edit.twig
+++ b/resources/views/v1/transactions/mass/edit.twig
@@ -173,10 +173,10 @@
     </form>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var what = "";
     </script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/transactions/mass/edit.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/common/autocomplete.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/transactions/mass/edit.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}
diff --git a/resources/views/v1/transactions/show.twig b/resources/views/v1/transactions/show.twig
index eacfb53926..bbfb9d6637 100644
--- a/resources/views/v1/transactions/show.twig
+++ b/resources/views/v1/transactions/show.twig
@@ -407,12 +407,12 @@
 
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         var modalDialogURI = '{{ route('transactions.link.modal', ['%JOURNAL%']) }}';
         var acURI = '{{ route('json.autocomplete.all-journals-with-id') }}';
         var groupURI = '{{ route('transactions.show',['%GROUP%']) }}';
     </script>
-    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}"></script>
-    <script type="text/javascript" src="v1/js/ff/transactions/show.js?v={{ FF_VERSION }}"></script>
+    <script type="text/javascript" src="v1/js/lib/typeahead/typeahead.bundle.min.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+    <script type="text/javascript" src="v1/js/ff/transactions/show.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
 {% endblock %}