Index: openacs-4/packages/acs-admin/www/apm/package-add.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-admin/www/apm/package-add.tcl,v
diff -u -r1.13.2.1 -r1.13.2.2
--- openacs-4/packages/acs-admin/www/apm/package-add.tcl	10 Sep 2015 08:21:01 -0000	1.13.2.1
+++ openacs-4/packages/acs-admin/www/apm/package-add.tcl	27 Sep 2016 07:54:35 -0000	1.13.2.2
@@ -21,10 +21,10 @@
 		 $title]
 
 set form_name "packageAdd"
-set body "<form name='$form_name' action='package-add-2' method='post'>\n"
-append body [subst {
+set body [subst {
+<form name='$form_name' action='package-add-2' method='post'>
 [export_vars -form {package_id version_id}] 
-<script type="text/javascript">
+<script type="text/javascript" nonce='$::__csp_nonce'>
 function updateURLs() {
     // Update the package and version URL, if the package key and/or version name change.
     var form = document.getElementsByName('$form_name')\[0\];
@@ -33,9 +33,7 @@
     if ((form.version_name.value != '') && (form.version_uri.value == ''))
         form.version_uri.value = 'http://openacs.org/repository/download/apm/' + form.package_key.value + '-' + form.version_name.value + '.apm';
 }
-</script>
 
-<script type="text/javascript">
 function checkMailto(element) {
     // If it looks like an email address without a mailto: (contains an @ but
     // no colon) then prepend 'mailto:'.