Index: openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.adp,v
diff -u -r1.8 -r1.9
--- openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.adp	7 Aug 2017 23:48:31 -0000	1.8
+++ openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.adp	18 Dec 2018 16:13:04 -0000	1.9
@@ -32,9 +32,16 @@
     @sub_files.mime_type@
     <if @sub_files.mime_type@ in "image/jpeg" "image/png" "image/gif">
       <img id="@sub_files.img_id@" src="@sub_files.download_url@" height="60" width="100">
+      <if @sub_files.image_p;literal@ true>
+        <script type="text/javascript"<if @::__csp_nonce@ not nil> nonce="@::__csp_nonce;literal@"</if>>
+          document.getElementById('@sub_files.img_id@').addEventListener('click', function (event) {
+             changePreview("@sub_files.download_url@","@sub_files.name@", "@sub_files.mime_type@");
+          });
+        </script>
+      </if>
     <!-- </a> -->
     </if>
-<small><br>@sub_files.date@ </small><a href="@sub_files.url@?m=delete&amp;return_url=@return_url@"><img src="/resources/acs-subsite/Delete16.gif" width="16" height="16" border="0" alt="delete" title="Delete" ></a>
+<small><br>@sub_files.date@ </small><a href="@sub_files.delete_url@"><img src="/resources/acs-subsite/Delete16.gif" width="16" height="16" border="0" alt="delete" title="Delete" ></a>
 </center>
 </div>
 <br/>
Index: openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.tcl,v
diff -u -r1.7 -r1.8
--- openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.tcl	7 Aug 2017 23:48:31 -0000	1.7
+++ openacs-4/packages/xowiki/www/ckeditor-images/thumb-view.tcl	18 Dec 2018 16:13:04 -0000	1.8
@@ -11,11 +11,12 @@
 }
 
 set output ""
-set return_url [export_vars -base [ad_conn url] {parent_id}]
+set return_url [export_vars -base [ad_conn url] -no_empty {parent_id}]
 db_multirow -extend {
-  url
+  delete_url
   download_url
   img_id
+  image_p
 } sub_files get_children "
 select package_id,name,cr.title,cr.item_id,revision_id,mime_type, to_char(publish_date, 'yyyy-mm-dd, HH:MM') as date 
  from cr_items ci inner join cr_revisions cr on (ci.item_id = cr.item_id)
@@ -26,17 +27,13 @@
           ::xowiki::Package initialize -package_id $package_id
           set item [::xowiki::File get_instance_from_db -item_id $item_id]
 	  set url [$item pretty_link]
-          set download_url "${url}?m=download"
+          set download_url [export_vars -base $url {{m download}}]
+          set delete_url [export_vars -base $url {{m delete} return_url}]
           set img_id "preview-img-${revision_id}"
-          if {$mime_type in {"image/jpeg" "image/png" "image/gif"}} {
-            template::add_event_listener -id $img_id -script [subst {
-              changePreview('${download_url}','${name}', '${mime_type}');
-            }]
-          }
+          set image_p [expr {$mime_type in {"image/jpeg" "image/png" "image/gif"}}]
 	}
 
 
-
 set server_url ""
 
 # Local variables: