flask-appbuilder 3.2.1rc1__py3-none-any.whl → 5.0.2__py3-none-any.whl

flask_appbuilder/templates/appbuilder/baselib.html

@@ -21,7 +21,7 @@
     {% if item1 | is_menu_visible %}
         {% if item1.childs %}
             <li class="dropdown">
-				<a class="dropdown-toggle" data-toggle="dropdown" href="javascript:void(0)">
+				<a class="dropdown-toggle" data-toggle="dropdown" href="#">
             {% if item1.icon %}
                 <i class="fa {{item1.icon}}"></i>&nbsp;
             {% endif %}
@@ -53,12 +53,12 @@
 {% endmacro %}
 
 {% macro locale_menu(languages) %}
-{% set locale = session['locale'] %}
+{% set locale = session.get('locale') %}
 {% if not locale %}
 	{% set locale = 'en' %}
 {% endif %}
 <li class="dropdown">
-	<a class="dropdown-toggle" data-toggle="dropdown" href="javascript:void(0)">
+	<a class="dropdown-toggle" data-toggle="dropdown" href="#">
 	   <div class="f16"><i class="flag {{languages[locale].get('flag')}}"></i><b class="caret"></b>
        </div>
 	</a>
@@ -126,3 +126,9 @@
    </div>
 </div>
 {% endmacro %}
+
+{% macro get_nonce() -%}
+    {%- if csp_nonce is defined -%}
+        {{- csp_nonce() -}}
+    {%- endif %}
+{%- endmacro %}

flask_appbuilder/templates/appbuilder/general/lib.html

@@ -1,3 +1,5 @@
+{% import 'appbuilder/baselib.html' as baselib %}
+
 {% macro render_additional_links(additional_links, pk) %}
     {% if additional_links %}
         {% for item in additional_links %}
@@ -20,16 +22,27 @@
                 {% endif %}
                 <input type="hidden" id="action" name="action" />
             </form>
-
-            <a href="javascript:void(0)" class="btn btn-sm btn-primary"
-               {% if action.confirmation %}
-               onclick="var a = new AdminActions(); return a.execute_single('{{path}}','{{action.confirmation}}');">
-               {% else %}
-               onclick="var a = new AdminActions(); return a.execute_single('{{path}}',false);">
-               {% endif %}
+            <a
+                id="btn-action-{{ endpoint }}-{{ action.name }}"
+                href="#"
+                class="btn btn-sm btn-primary"
+            >
                 <i class="fa {{action.icon}}"></i>
-                    {{_(action.text)}}
-                </a>
+                {{_(action.text)}}
+            </a>
+
+            <script nonce="{{ baselib.get_nonce() }}">
+                document.getElementById("btn-action-{{ endpoint }}-{{ action.name }}")
+                    .addEventListener("click", function () {
+                        {% if action.confirmation %}
+                            const adminAction = new AdminActions();
+                            return adminAction.execute_single('{{path}}','{{action.confirmation}}');
+                        {% else %}
+                            const adminAction = new AdminActions();
+                            return adminAction.execute_single('{{path}}',false);
+                        {% endif %}
+                    })
+            </script>
         {% endif %}
     {% endfor %}
 {% endmacro %}
@@ -66,7 +79,7 @@
         {% for action_key in actions %}
             {% set action = actions.get(action_key) %}
                 <li>
-                    <a href="javascript:void(0)"
+                    <a href="#"
                         class="{{action.name}}_menu_item">
                         <i class="fa {{action.icon}}"></i>
                         {{ _(action.text) }}
@@ -74,7 +87,7 @@
                 </li>
         {% endfor %}
     </ul>
-    <script type="text/javascript">
+    <script nonce="{{ baselib.get_nonce() }}">
     $(document).ready(function() {
     {% for action_key in actions %}
         {% set action = actions.get(action_key) %}
@@ -176,7 +189,7 @@
     </li>
     {% else %}
     <li class="disabled">
-        <a href="javascript:void(0)">&laquo;</a>
+        <a href="#">&laquo;</a>
     </li>
     {% endif %}
     {% if page > 0 %}
@@ -185,14 +198,14 @@
     </li>
     {% else %}
     <li class="disabled">
-        <a href="javascript:void(0)">&lt;</a>
+        <a href="#">&lt;</a>
     </li>
     {% endif %}
 
     {% for p in range(min, max) %}
         {% if page == p %}
         <li class="active">
-            <a href="javascript:void(0)">{{ (p + 1) }}</a>
+            <a href="#">{{ (p + 1) }}</a>
         </li>
         {% else %}
         <li>
@@ -207,7 +220,7 @@
         </li>
     {% else %}
         <li class="disabled">
-            <a href="javascript:void(0)">&gt;</a>
+            <a href="#">&gt;</a>
         </li>
     {% endif %}
     {% if max < pages %}
@@ -216,7 +229,7 @@
         </li>
     {% else %}
         <li class="disabled">
-            <a href="javascript:void(0)">&raquo;</a>
+            <a href="#">&raquo;</a>
         </li>
     {% endif %}
 </ul>
@@ -225,22 +238,18 @@
 
 
 {% macro render_field(field, begin_sep_label='', end_sep_label='', begin_sep_field='', end_sep_field='') %}
-      {% if field.id != 'csrf_token' %}
-          {% if field.type == 'HiddenField' %}
-            {{ field}}
-          {% else %}
-            {{begin_sep_label|safe}}
-                <label for="{{field.id}}" control-label>
-                    {{ field.label.text }}
-                    {% if field.flags.required %}
-                        <strong style="color: red">&#42;</strong>
-                    {% endif %}
-                </label>
-            {{end_sep_label|safe}}
-            {{begin_sep_field|safe}}
-                {{ field(**kwargs)|safe }}
-               <span class="help-block">{{ field.description }}</span>
-          {% endif %}
+      {% if (field.id != 'csrf_token') and (field.type != 'HiddenField') %}
+          {{begin_sep_label|safe}}
+              <label for="{{field.id}}" control-label>
+                  {{ field.label.text }}
+                  {% if field.flags.required %}
+                      <strong style="color: red">&#42;</strong>
+                  {% endif %}
+              </label>
+          {{end_sep_label|safe}}
+          {{begin_sep_field|safe}}
+              {{ field(**kwargs)|safe }}
+              <span class="help-block">{{ field.description }}</span>
           {% if field.errors %}
             <div class="alert alert-danger">
             {% for error in field.errors %}
@@ -362,6 +371,7 @@
 {% macro lnk_back() %}
     <a href="{{url_for('UtilView' + '.back')}}" class="btn btn-sm btn-default" data-toggle="tooltip" rel="tooltip"
        title="{{_('Back')}}">
+        <span class="sr-only">{{ _('Back') }}</span>
         <i class="fa fa-arrow-left"></i>
     </a>
 {% endmacro %}
@@ -370,6 +380,7 @@
 {% macro lnk_add(my_href) %}
     <a href="{{my_href}}" class="btn btn-sm btn-primary" data-toggle="tooltip" rel="tooltip"
        title="{{_('Add a new record')}}">
+        <span class="sr-only">{{ _('Add') }}</span>
         <i class="fa fa-plus"></i>
     </a>
 {% endmacro %}
@@ -377,6 +388,7 @@
 {% macro lnk_edit(my_href) %}
     <a href="{{my_href}}" class="btn btn-sm btn-default" data-toggle="tooltip" rel="tooltip"
        title="{{_('Edit record')}}">
+        <span class="sr-only">{{ _('Edit') }}</span>
         <i class="fa fa-edit"></i>
     </a>
 {% endmacro %}
@@ -384,13 +396,27 @@
 {% macro lnk_show(my_href) %}
     <a href="{{my_href}}" class="btn btn-sm btn-default" data-toggle="tooltip" rel="tooltip"
        title="{{_('Show record')}}">
+        <span class="sr-only">{{ _('Show') }}</span>
         <i class="fa fa-search"></i>
     </a>
 {% endmacro %}
 
 {% macro lnk_delete(my_href) %}
-    <a href="javascript:void(0)" class="btn btn-sm btn-default confirm" rel="tooltip" title="{{_('Delete record')}}"
-       onclick="var a = new AdminActions(); return a.execute_single_delete('{{my_href}}','{{ _('You sure you want to delete this item?') }}');">
+    <a
+        id="btn-delete-{{ my_href }}"
+        href="#"
+        class="btn btn-sm btn-default confirm"
+        rel="tooltip"
+        title="{{_('Delete record')}}"
+    >
+        <span class="sr-only">{{ _('Delete') }}</span>
         <i class="fa fa-trash"></i>
     </a>
+    <script nonce="{{ baselib.get_nonce() }}">
+        document.getElementById("btn-delete-{{ my_href }}")
+            .addEventListener("click", function () {
+                const adminAction = new AdminActions();
+                return adminAction.execute_single_delete('{{my_href}}','{{_('Are you sure you want to delete this item?')}}');
+            })
+    </script>
 {% endmacro %}

flask_appbuilder/templates/appbuilder/general/model/edit.html

@@ -32,5 +32,5 @@
 {% endblock %}
 
 {% block add_tail_js %}
-<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}"></script>
+<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}" nonce="{{ baselib.get_nonce() }}"></script>
 {% endblock %}

flask_appbuilder/templates/appbuilder/general/model/edit_cascade.html

@@ -25,5 +25,5 @@
 {% endblock %}
 
 {% block add_tail_js %}
-<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}"></script>
+<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}" nonce="{{ baselib.get_nonce() }}"></script>
 {% endblock %}

flask_appbuilder/templates/appbuilder/general/model/search.html

@@ -1,3 +1,5 @@
+{% import 'appbuilder/baselib.html' as baselib %}
+
 <form class="form-search" action="" method="post">
 <div class="table-responsive">
 <table class="table table-condensed"><tr>
@@ -11,7 +13,6 @@
 </table>
 </div>
 </form>
-<script>
+<script nonce="{{ baselib.get_nonce() }}">
 $(".my_select2").prepend("<option value=''></option>");
 </script>
-

flask_appbuilder/templates/appbuilder/general/model/show.html

@@ -34,5 +34,5 @@
 {% endblock content %}
 
 {% block add_tail_js %}
-<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}"></script>
+<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}" nonce="{{ baselib.get_nonce() }}"></script>
 {% endblock %}

flask_appbuilder/templates/appbuilder/general/model/show_cascade.html

@@ -24,5 +24,5 @@
 {% endblock %}
 
 {% block add_tail_js %}
-<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}"></script>
+<script src="{{url_for('appbuilder.static',filename='js/ab_keep_tab.js')}}" nonce="{{ baselib.get_nonce() }}"></script>
 {% endblock %}

flask_appbuilder/templates/appbuilder/general/security/login_db.html

@@ -16,29 +16,29 @@
                 <form class="form" action="" method="post" name="login">
                     {{form.hidden_tag()}}
                     <div class="help-block">{{_("Enter your login and password below")}}:</div>
-                    <div class="control-group{% if form.errors.openid is defined %} error{% endif %}">
-                        <label class="control-label" for="openid">{{_("Username")}}:</label>
+                    <div class="control-group{% if form.errors.username is defined %} error{% endif %}">
+                        <label class="control-label" for="username">{{_("Username")}}:</label>
 
                         <div class="controls">
                             <div class="input-group">
                                 <span class="input-group-addon"><i class="fa fa-user"></i></span>
                                 {{ form.username(size = 80, class = "form-control", autofocus = true) }}
                             </div>
-                            {% for error in form.errors.get('openid', []) %}
+                            {% for error in form.errors.get('username', []) %}
                             <span class="help-inline">[{{error}}]</span><br>
                             {% endfor %}
-                            <label class="control-label" for="openid">{{_("Password")}}:</label>
+                            <label class="control-label" for="password">{{_("Password")}}:</label>
 
                             <div class="input-group">
                                 <span class="input-group-addon"><i class="fa fa-key"></i></span>
                                 {{ form.password(size = 80, class = "form-control") }}
                             </div>
-                            {% for error in form.errors.get('openid', []) %}
+                            {% for error in form.errors.get('password', []) %}
                             <span class="help-inline">[{{error}}]</span><br>
                             {% endfor %}
                         </div>
                     </div>
-                    
+
                     <div class="control-group">
                         <div class="controls">
                             <br>
@@ -54,7 +54,7 @@
                         </div>
                     </div>
                 </form>
-                
+
             </div>
         </div>
     </div>

flask_appbuilder/templates/appbuilder/general/security/login_ldap.html

@@ -14,22 +14,22 @@
     <form class="form" action="" method="post" name="login">
         {{form.hidden_tag()}}
         <div class="help-block">{{_("Enter your login and password below")}}:</div>
-        <div class="control-group{% if form.errors.openid is defined %} error{% endif %}">
-            <label class="control-label" for="openid">{{_("Username")}}:</label>
+        <div class="control-group{% if form.errors.username is defined %} error{% endif %}">
+            <label class="control-label" for="username">{{_("Username")}}:</label>
             <div class="controls">
                 <div class="input-group">
                 <span class="input-group-addon"><i class="fa fa-user"></i></span>
                 {{ form.username(size = 80, class = "form-control", autofocus = true) }}
                 </div>
-                {% for error in form.errors.get('openid', []) %}
+                {% for error in form.errors.get('username', []) %}
                     <span class="help-inline">[{{error}}]</span><br>
                 {% endfor %}
-		<label class="control-label" for="openid">{{_("Password")}}:</label>
+		<label class="control-label" for="password">{{_("Password")}}:</label>
 		        <div class="input-group">
                 <span class="input-group-addon"><i class="fa fa-key"></i></span>
                 {{ form.password(size = 80, class = "form-control") }}
                 </div>
-                {% for error in form.errors.get('openid', []) %}
+                {% for error in form.errors.get('password', []) %}
                     <span class="help-inline">[{{error}}]</span><br>
                 {% endfor %}
             </div>

flask_appbuilder/templates/appbuilder/general/security/login_oauth.html

@@ -3,36 +3,6 @@
 
 {% block content %}
 
-<script type="text/javascript">
-
-    var baseLoginUrl = "{{appbuilder.get_url_for_login}}";
-    var baseRegisterUrl = "{{appbuilder.get_url_for_login}}";
-    var next = "?next={{request.args.get('next', '')}}"
-
-    var currentSelection = "";
-
-    function set_openid(pr) {
-        $('.provider-select').removeClass('fa-black');
-        $('#' + pr).addClass('fa-black');
-        currentSelection = pr;
-    }
-
-
-    function signin() {
-        if (currentSelection != "") {
-            window.location.href = baseLoginUrl + currentSelection + next;
-        }
-    }
-
-    function register() {
-        if (currentSelection != "") {
-            window.location.href = baseRegisterUrl + currentSelection + '/register' + next;
-        }
-    }
-
-
-</script>
-
 <div class="container">
     <div id="loginbox" style="margin-top:50px;" class="mainbox col-md-6 col-md-offset-3 col-sm-8 col-sm-offset-2">
         <div class="panel panel-primary">
@@ -40,31 +10,36 @@
                 <div class="panel-title">{{ title }}</div>
             </div>
             <div style="padding-top:30px" class="panel-body">
-
-                <div class="help-block">{{_("Please choose one of the following providers:")}}</div>
-                <div class="center-block btn-group btn-group-lg" role="group">
-                    <center>
-                        {% for pr in providers %}
-                        <a class="btn btn-primary" href="javascript:set_openid('{{pr.name}}');">
-                            <i id="{{pr.name}}" class="provider-select fa {{pr.icon}} fa-3x"></i>
-                        </a>
-                        {% endfor %}
-                    </center>
-                </div>
                 <div>
-                    <br></br>
-                    <a onclick="signin();" class="btn btn-primary btn-block" type="submit">{{_('Sign In')}}</a>
-                    {% if appbuilder.sm.auth_user_registration %}
-                    <a onclick="register();" class="btn btn-block btn-primary" data-toggle="tooltip" rel="tooltip"
-                        title="{{_('If you are not already a user, please register')}}">
-                        {{_('Register')}}
+                    {% for provider in providers %}
+                    <a
+                        id="btn-signin-{{provider.name}}"
+                        class="btn btn-primary btn-block"
+                        type="submit"
+                    >
+                        {{_('Sign In with ')}}{{ provider.name }}
+                        <i id="{{provider.name}}" class="provider-select fa {{provider.icon}} fa-1x"></i>
                     </a>
-                    {% endif %}
+                    {% endfor %}
                 </div>
             </div>
         </div>
     </div>
 </div>
 
+<script nonce="{{ baselib.get_nonce() }}">
+    var baseLoginUrl = "{{appbuilder.get_url_for_login}}";
+    var baseRegisterUrl = "{{appbuilder.get_url_for_login}}";
+    var next = "?next=" + "{{request.args.get('next', '') | urlencode}}";
+
+    function signin(provider) {
+        window.location.href = baseLoginUrl + provider + next;
+    }
 
-{% endblock %}
+    {% for provider in providers %}
+        document.getElementById("btn-signin-{{provider.name}}")
+            .addEventListener("click", function () { signin("{{provider.name}}") })
+    {% endfor %}
+
+</script>
+{% endblock %}

flask_appbuilder/templates/appbuilder/general/widgets/base_list.html

@@ -1,3 +1,4 @@
+{% import 'appbuilder/baselib.html' as baselib %}
 {% import 'appbuilder/general/lib.html' as lib %}
 
 {% set can_add = "can_add" | is_item_visible(modelview_name) %}
@@ -28,7 +29,7 @@
 
     {{ lib.action_form(actions, modelview_name) }}
 
-    <script language="javascript">
+    <script nonce="{{ baselib.get_nonce() }}">
         $(document).ready(function() {
             window.modelActions = new AdminActions();
         });

flask_appbuilder/templates/appbuilder/general/widgets/chart.html

@@ -1,8 +1,10 @@
+{% import 'appbuilder/baselib.html' as baselib %}
+
 <div id="chart" style="height: {{height}};">
 </div>
 
-<script type="text/javascript" src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}"></script>
-<script type="text/javascript">
+<script nonce="{{ baselib.get_nonce() }}" src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}"></script>
+<script nonce="{{ baselib.get_nonce() }}">
             //load the Google Visualization API and the chart
             google.load('visualization', '1', {'packages': ['corechart','gauge']});
 

flask_appbuilder/templates/appbuilder/general/widgets/direct_chart.html

@@ -1,7 +1,9 @@
+{% import 'appbuilder/baselib.html' as baselib %}
+
 <div id="{{ modelview_name }}" style="height: {{height}};">
 </div>
-<script type="text/javascript" src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}"></script>
-<script type="text/javascript">
+<script src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}" nonce="{{ baselib.get_nonce() }}"></script>
+<script nonce="{{ baselib.get_nonce() }}">
     //load the Google Visualization API and the chart
     google.load('visualization', '1', {'packages': ['corechart']});
 
@@ -11,7 +13,6 @@
 
     var jsonData{{ modelview_name }} = {{ value_columns | tojson }}
 
-
     //-----------------------------------
     // Attach listener for tab open event
     //-----------------------------------

flask_appbuilder/templates/appbuilder/general/widgets/multiple_chart.html

@@ -1,6 +1,7 @@
+{% import 'appbuilder/baselib.html' as baselib %}
 
-<script type="text/javascript" src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}"></script>
-<script type="text/javascript">
+<script nonce="{{ baselib.get_nonce() }}" src="{{url_for('appbuilder.static',filename='js/google_charts.js')}}"></script>
+<script nonce="{{ baselib.get_nonce() }}">
             //load the Google Visualization API and the chart
             google.load('visualization', '1', {'packages': ['corechart']});
 

flask_appbuilder/templates/appbuilder/general/widgets/search.html

@@ -1,3 +1,4 @@
+{% import 'appbuilder/baselib.html' as baselib %}
 {% import 'appbuilder/general/lib.html' as lib %}
 
 <form id="filter_form" class="form-search" method="get">
@@ -9,7 +10,7 @@
         </button>
         <ul class="dropdown-menu">
             {% for col in include_cols %}
-            <li><a href="javascript:void(0)" name="{{col}}" class="filter" onclick="return false;">
+            <li><a href="#" name="{{col}}" class="filter">
                 {{ label_columns[col] }}</a>
             </li>
             {% endfor %}
@@ -25,15 +26,15 @@
 {{ lib.btn_search() }}
 </form>
 
-<script>
+<script nonce="{{ baselib.get_nonce() }}">
 	(function($) {
-	var filter = new AdminFilters(
-                    '#filter_form',
-                    {{ label_columns | tojson }},
-                    {{ form_fields | tojson }},
-                    {{ search_filters | tojson }},
-                    {{ active_filters | tojson }}
-                );
-	})(jQuery);
+        const filter = new AdminFilters(
+            '#filter_form',
+            {{ label_columns | tojson }},
+            {{ form_fields | tojson }},
+            {{ search_filters | tojson }},
+            {{ active_filters | tojson }}
+        );
+    })(jQuery);
 
 </script>

flask_appbuilder/templates/appbuilder/init.html

@@ -1,8 +1,7 @@
 {% import 'appbuilder/baselib.html' as baselib with context %}
 
-
 {% if appbuilder %}
-    {% set app_name = appbuilder.app_name %}
+  {% set app_name = appbuilder.app_name %}
 {% endif %}
 
 <!DOCTYPE html>
@@ -11,54 +10,49 @@
     <title>{% block page_title %}{{app_name}}{% endblock %}</title>
 
     {% block head_meta %}
-        <meta name="viewport" content="width=device-width, initial-scale=1.0">
-        <meta name="description" content="">
-        <meta name="author" content="">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <meta name="description" content="">
+      <meta name="author" content="">
     {% endblock %}
-    {% block head_css %}
-        <link href="{{url_for('appbuilder.static',filename='css/bootstrap.min.css')}}" rel="stylesheet">
-        <link href="{{url_for('appbuilder.static',filename='css/font-awesome.min.css')}}" rel="stylesheet">
-        {% if appbuilder.app_theme %}
-           <link href="{{url_for('appbuilder.static',filename='css/themes/'+ appbuilder.app_theme )}}"  rel="stylesheet">
-        {% endif %}
 
-         <!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
-         <!--[if lt IE 9]>
-            <script src="{{url_for('appbuilder.static',filename='js/html5shiv.js')}}"></script>
-            <script src="{{url_for('appbuilder.static',filename='js/respond.min.js')}}"></script>
-         <![endif]-->
-
-        <link href="{{url_for('appbuilder.static',filename='datepicker/bootstrap-datepicker.css')}}" rel="stylesheet">
-        <link href="{{url_for('appbuilder.static',filename='select2/select2.css')}}" rel="stylesheet">
-        <link href="{{url_for('appbuilder.static',filename='css/flags/flags16.css')}}" rel="stylesheet">
-        <link href="{{url_for('appbuilder.static',filename='css/ab.css')}}" rel="stylesheet">
+    {% block head_css %}
+      <link href="{{url_for('appbuilder.static',filename='css/bootstrap.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/fontawesome/fontawesome.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/fontawesome/regular.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/fontawesome/solid.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/fontawesome/brands.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/fontawesome/v4-shims.min.css')}}" rel="stylesheet">
+      {% if appbuilder.app_theme %}
+        <link href="{{url_for('appbuilder.static',filename='css/themes/'+ appbuilder.app_theme )}}" rel="stylesheet">
+      {% endif %}
+      <link href="{{url_for('appbuilder.static',filename='css/bootstrap-datepicker/bootstrap-datepicker3.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/select2/select2.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/select2/select2-bootstrap.min.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/flags/flags16.css')}}" rel="stylesheet">
+      <link href="{{url_for('appbuilder.static',filename='css/ab.css')}}" rel="stylesheet">
     {% endblock %}
+
     {% block head_js %}
-        <script src="{{url_for('appbuilder.static',filename='js/jquery-latest.js')}}"></script>
-        <script src="{{url_for('appbuilder.static',filename='js/ab_filters.js')}}"></script>
-        <script src="{{url_for('appbuilder.static',filename='js/ab_actions.js')}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/jquery-latest.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/ab_filters.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/ab_actions.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+    {% endblock %}
+  </head>
+  <body >
+    {% block body %}
     {% endblock %}
 
-</head>
-
-<body >
-
-{% block body %}
-{% endblock %}
-
-
-{% block tail_js %}
-    <script src="{{url_for('appbuilder.static',filename='js/bootstrap.min.js')}}"></script>
-    <script src="{{url_for('appbuilder.static',filename='datepicker/bootstrap-datepicker.js')}}"></script>
-    <script src="{{url_for('appbuilder.static',filename='select2/select2.js')}}"></script>
-    <script src="{{url_for('appbuilder.static',filename='js/ab.js')}}"></script>
-{% endblock %}
-
-{% block add_tail_js %}
-{% endblock %}
+    {% block tail_js %}
+      <script src="{{url_for('appbuilder.static',filename='js/bootstrap.min.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/bootstrap-datepicker/bootstrap-datepicker.min.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/select2/select2.min.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+      <script src="{{url_for('appbuilder.static',filename='js/ab.js')}}" nonce="{{baselib.get_nonce()}}"></script>
+    {% endblock %}
 
-{% block tail %}
-{% endblock %}
+    {% block add_tail_js %}
+    {% endblock %}
 
+    {% block tail %}
+    {% endblock %}
   </body>
 </html>