Index: openacs-4/packages/acs-admin/www/apm/package-add.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-admin/www/apm/package-add.tcl,v
diff -u -r1.13.2.2 -r1.13.2.3
--- openacs-4/packages/acs-admin/www/apm/package-add.tcl	27 Sep 2016 07:54:35 -0000	1.13.2.2
+++ openacs-4/packages/acs-admin/www/apm/package-add.tcl	28 Sep 2016 12:56:29 -0000	1.13.2.3
@@ -40,7 +40,7 @@
     if (element.value.indexOf('@') >= 0 && element.value.indexOf(':') < 0)
         element.value = 'mailto:' + element.value;
 }
-</script>
+ </script>
 
 <table>
 
@@ -54,7 +54,7 @@
 
 <tr>
   <th align="right" nowrap>Package Key:</th>
-  <td><input name="package_key" size="30" onChange="updateURLs()"></td>
+  <td><input name="package_key" id="package_key" size="30"></td>
 </tr>
 
 <tr>
@@ -149,7 +149,7 @@
 
 <tr>
   <th align="right" nowrap>Initial Version:</th>
-  <td><input name="version_name" size="10" onChange="updateURLs()"></td>
+  <td><input name="version_name" id="version_name" size="10"></td>
 </tr>
 
 <tr>
@@ -257,9 +257,16 @@
 
 ad_return_template apm
 
+# Add onChange event listener to package_key and version_name fields to comply with CSP.
+# No inline JS event handlers!
+template::add_body_script -script "
+    var elem = document.getElementById('package_key');
+    elem.addEventListener('change', function (event) {updateURLs();});
+    
+    var elem = document.getElementById('version_name');
+    elem.addEventListener('change', function (event) {updateURLs();});"
 
 
-
 # Local variables:
 #    mode: tcl
 #    tcl-indent-level: 4