Fix #155 -- Remove javascript URIs for CSP (#261)

* remove javascript URIs for CSP

#155

* remove javascript URIs for CSP
Issue 155

Combining js error handling files.

src/pretix/base/templates/400.html

@@ -7,7 +7,7 @@
     <p>{% trans "We were unable to parse your request." %}</p>
     <p>{{ exception }}</p>
     <p class="links">
-        <a href="javascript:history.back()">{% trans "Take a step back" %}</a>
-        &middot; <a href="javascript:location.reload()">{% trans "Try again" %}</a>
+        <a id='goback' href='#'>{% trans "Take a step back" %}</a>
+        &middot; <a id='reload' href='#'>{% trans "Try again" %}</a>
     </p>
-{% endblock %}
+{% endblock %}

src/pretix/base/templates/403.html

@@ -7,7 +7,7 @@
     <p>{% trans "You do not have access to this page." %}</p>
     <p>{{ exception }}</p>
     <p class="links">
-        <a href="javascript:history.back()">{% trans "Take a step back" %}</a>
-        &middot; <a href="javascript:location.reload()">{% trans "Try again" %}</a>
+        <a id='goback' href='#'>{% trans "Take a step back" %}</a>
+        &middot; <a id='reload' href='#'>{% trans "Try again" %}</a>
     </p>
-{% endblock %}
+{% endblock %}

src/pretix/base/templates/404.html

@@ -7,6 +7,6 @@
     <p>{% trans "I'm afraid we could not find the the resource you requested." %}</p>
     <p>{{ exception }}</p>
     <p class="links">
-        <a href="javascript:history.back()">{% trans "Take a step back" %}</a>
+        <a id='goback' href='#'>{% trans "Take a step back" %}</a>
     </p>
-{% endblock %}
+{% endblock %}

src/pretix/base/templates/500.html

@@ -8,7 +8,7 @@
     <p>{% trans "If this problem persists, please contact us." %}</p>
     <p>{{ exception }}</p>
     <p class="links">
-        <a href="javascript:history.back()">{% trans "Take a step back" %}</a>
-        &middot; <a href="javascript:location.reload()">{% trans "Try again" %}</a>
+        <a id='goback' href='#'>{% trans "Take a step back" %}</a>
+        &middot; <a id='reload' href='#'>{% trans "Try again" %}</a>
     </p>
-{% endblock %}
+{% endblock %}

src/pretix/base/templates/csrffail.html

@@ -19,6 +19,6 @@
         {% endblocktrans %}</p>
     {% endif %}
     <p class="links">
-        <a href="javascript:history.back()">{% trans "Take a step back" %}</a>
+        <a id='goback' href='#'>{% trans "Take a step back" %}</a>
     </p>
-{% endblock %}
+{% endblock %}

src/pretix/base/templates/error.html

@@ -16,4 +16,5 @@
     {% block content %}{% endblock %}
 </div>
 </body>
+<script src="{% static "pretixbase/js/errors.js" %}"></script>
 </html>

src/static/pretixbase/js/errors.js

@@ -0,0 +1,5 @@
+document.getElementById('goback').onclick =
+   function() {window.history.back()};
+
+document.getElementById('reload').onclick =
+ function() {window.location.reload(true)};