change output format

Signed-off-by: MiniDigger <admin@minidigger.me>
2025-02-23 15:12:52 +08:00 · 2020-10-31 17:46:57 +01:00 · 2020-10-31 17:46:57 +01:00 · 1d30c01fd3
commit 1d30c01fd3
parent 5e0ff0f6fc
35 changed files with 185 additions and 119 deletions
--- a/src/main/java/io/papermc/hangar/config/WebConfig.java
+++ b/src/main/java/io/papermc/hangar/config/WebConfig.java
@ -1,6 +1,8 @@
 package io.papermc.hangar.config;

 import com.fasterxml.jackson.databind.ObjectMapper;
+
+import freemarker.core.HTMLOutputFormat;
 import freemarker.template.TemplateException;
 import io.papermc.hangar.controller.converters.ColorHexConverter;
 import io.papermc.hangar.controller.converters.StringToEnumConverterFactory;
@ -64,12 +66,17 @@ public class WebConfig extends WebMvcConfigurationSupport {
        freeMarkerConfigurer.getConfiguration().setOutputEncoding("UTF-8");
        freeMarkerConfigurer.getConfiguration().setLogTemplateExceptions(false);
        freeMarkerConfigurer.getConfiguration().setAPIBuiltinEnabled(true);
+        freeMarkerConfigurer.getConfiguration().setOutputFormat(HTMLOutputFormat.INSTANCE);
        freeMarkerConfigurer.getConfiguration().setObjectWrapper(new Java8ObjectWrapper(freemarker.template.Configuration.getVersion()));
        freeMarkerConfigurer.getConfiguration().setTemplateExceptionHandler((te, env, out) -> {
            String message = te.getMessage();
            if (message.contains("org.springframework.web.servlet.support.RequestContext.getMessage")) {
                System.out.println("[Template Error, most likely missing key] " + message);
-                te.getCause().printStackTrace();
+                if (te.getCause() != null) {
+                    te.getCause().printStackTrace();
+                } else {
+                    te.printStackTrace();
+                }
            } else if (message.contains(" see cause exception in the Java stack trace.")) {
                te.printStackTrace();
            } else {
--- a/src/main/resources/templates/createOrganization.ftlh
+++ b/src/main/resources/templates/createOrganization.ftlh
@ -3,8 +3,8 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scripts>
-    <script type="text/javascript" src="<@hangar.url "js/orgCreate.js" />"></script>
-    <script type="text/javascript" src="<@hangar.url "js/membersConfig.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/orgCreate.js")}"></script>
+    <script type="text/javascript" src="${hangar.url("js/membersConfig.js")}"></script>
 </#assign>

 <#assign message><@spring.message "org.create.title" /></#assign>
--- a/src/main/resources/templates/errors/error.ftlh
+++ b/src/main/resources/templates/errors/error.ftlh
@ -4,7 +4,7 @@

 <@base.base title="Error" authEnabled=false noContainer=true>
    <div class="container-error container">
-    <img src="<@hangar.url "images/ore-dark.png" />" alt="Hangar logo" />
+    <img src="${hangar.url("images/ore-dark.png")}" alt="Hangar logo" />
    <h1 class="minor">Hangar is experiencing difficulties.</h1>
    <p class="minor">
        If you suspect this is a bug, please take a minute to report it to
--- a/src/main/resources/templates/errors/notFound.ftlh
+++ b/src/main/resources/templates/errors/notFound.ftlh
@ -5,7 +5,7 @@
 <#assign message><@spring.message "error.notFound.title" /></#assign>
 <@base.base title="${message}" authEnabled=true noContainer=true>
    <div class="container-error container">
-        <img src="<@hangar.url "images/ore-dark.png" />" alt="Hangar logo"/>
+        <img src="${hangar.url("images/ore-dark.png")}" alt="Hangar logo"/>
        <h1 class="minor"><@spring.message "error.notFound.title" /></h1>
        <h3 class="minor"><@spring.messageArgs code="error.notFound.message" args=[springMacroRequestContext.requestUri] /></h3>
    </div>
--- a/src/main/resources/templates/errors/timeout.ftlh
+++ b/src/main/resources/templates/errors/timeout.ftlh
@ -5,7 +5,7 @@
 <#assign message><@spring.message "error.notFound.title" /></#assign>
 <@base.base title="${message}" authEnabled=false noContainer=true>
    <div class="container-error container">
-        <img src="<@hangar.url "images/ore-dark.png" />" alt="Hangar logo" />
+        <img src="${hangar.url("images/ore-dark.png")}" alt="Hangar logo" />
        <h1 class="minor"><@spring.message "error.ore.timeout.title"/></h1>
        <i class="minor"><@spring.message "error.ore.timeout.body" /></i>
    </div>
--- a/src/main/resources/templates/home.ftlh
+++ b/src/main/resources/templates/home.ftlh
@ -8,18 +8,18 @@ sorted according to different criteria.
 <#import "*/layout/base.ftlh" as base>

 <#macro scripts>
-    <script src="<@hangar.url "js/home.js" />"></script>
+    <script src="${hangar.url("js/home.js")}"></script>
 </#macro>

 <#macro stylesheets>
-    <link rel="stylesheet" type="text/css" href="<@hangar.url "css/home.css" />" />
+    <link rel="stylesheet" type="text/css" href="${hangar.url("css/home.css")}" />
 </#macro>

 <#macro meta>
    <meta property="og:title" content="<@spring.message "general.appName" />">
    <meta property="og:type" content="website" />
    <meta property="og:url" content="${config.baseUrl}">
-    <meta property="og:image" content="<@hangar.url "images/ore-dark.png" />" />
+    <meta property="og:image" content="${hangar.url("images/ore-dark.png")}" />
    <meta property="og:description" content="<@spring.message "general.description" />" />
    <meta name="description" content="<@spring.message "general.description" />" />
 </#macro>
@ -40,7 +40,7 @@ sorted according to different criteria.
            <div class="col-md-9 hangar-banner">
                <div class="row aligned-row">
                    <div class="col-auto ore-logo">
-                        <img src="<@hangar.url "images/ore-colored.svg" />" alt="Ore logo" />
+                        <img src="${hangar.url("images/ore-colored.svg")}" alt="Ore logo" />
                    </div>
                    <div class="col-10 text">
                        <div class="headline">Hangar</div>
@ -55,7 +55,7 @@ sorted according to different criteria.
                        <#-- @ftlvariable name="sponsor" type="io.papermc.hangar.config.hangar.HangarConfig.Sponsor" -->
                        <#assign sponsor=randomSponsor() />
                        <a href="${sponsor.link}">
-                            <img class="logo" src="<@hangar.url sponsor.image />" alt="${sponsor.name}" />
+                            <img class="logo" src="${hangar.url(sponsor.image)}" alt="${sponsor.name}" />
                        </a>
                    </div>
                </div>
--- a/src/main/resources/templates/layout/base.ftlh
+++ b/src/main/resources/templates/layout/base.ftlh
@ -18,14 +18,14 @@ showFooter: Boolean = true, noContainer: Boolean = false, additionalMeta: Html =
        <link href="${config.security.api.url}" rel="dns-prefetch">
 <#--        <link href="<@hangar.config "app.discourseCdnUrl" />" rel="dns-prefetch">--><#--TODO this-->

-        <link rel="prefetch" href="<@hangar.url "images/favicon/favicon.ico" />">
+        <link rel="prefetch" href="${hangar.url("images/favicon/favicon.ico")}">
        <link rel="prefetch" href="https://fonts.googleapis.com/css?family=Montserrat:400,700">
-        <link rel="prefetch" href="<@hangar.url "css/chunk-common.css" />">
-        <link rel="prefetch" href="<@hangar.url "css/chunk-vendors.css" />">
-        <link rel="prefetch" href="<@hangar.url "css/main.css" />">
+        <link rel="prefetch" href="${hangar.url("css/chunk-common.css")}">
+        <link rel="prefetch" href="${hangar.url("css/chunk-vendors.css")}">
+        <link rel="prefetch" href="${hangar.url("css/main.css")}">

-        <link rel="prefetch" href="<@hangar.url "manifest/manifest.json" />">
-        <link rel="prefetch" href="<@hangar.url "js/bootstrap.js" />">
+        <link rel="prefetch" href="${hangar.url("manifest/manifest.json")}">
+        <link rel="prefetch" href="${hangar.url("js/bootstrap.js")}">

        <title>${title} | Hangar</title>

@ -40,24 +40,26 @@ showFooter: Boolean = true, noContainer: Boolean = false, additionalMeta: Html =
        <link rel="icon" type="image/png" sizes="16x16" href="/assets/images/favicon/favicon-16x16.png">

        <link rel="stylesheet" type="text/css" href="https://fonts.googleapis.com/css?family=Montserrat:400,700&display=swap" >
-        <link rel="stylesheet" type="text/css" href="<@hangar.url "css/chunk-common.css" />"/>
-        <link rel="stylesheet" type="text/css" href="<@hangar.url "css/chunk-vendors.css" />">
-        <link rel="stylesheet" type="text/css" href="<@hangar.url "css/main.css" />"/>
+        <link rel="stylesheet" type="text/css" href="${hangar.url("css/chunk-common.css")}"/>
+        <link rel="stylesheet" type="text/css" href="${hangar.url("css/chunk-vendors.css")}">
+        <link rel="stylesheet" type="text/css" href="${hangar.url("css/main.css")}"/>

        ${additionalStyling}

        <#-- See https://goo.gl/OOhYW5 and https://goo.gl/qRE0vM -->
-        <link rel="manifest" href="<@hangar.url "manifest/manifest.json" />">
+        <link rel="manifest" href="${hangar.url("manifest/manifest.json")}">
        <meta name="theme-color" content="#2980B9">

        <#-- google foo -->
        <script async src="https://www.googletagmanager.com/gtag/js?id=${config.gaCode}"></script>
-        <script>
+        <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.dataLayer = window.dataLayer || [];
            function gtag(){dataLayer.push(arguments);}
            gtag('js', new Date());

            gtag('config', '${config.gaCode}');
+            </#outputformat>
        </script>
        <script type="application/ld+json">
            {
@ -138,6 +140,7 @@ showFooter: Boolean = true, noContainer: Boolean = false, additionalMeta: Html =

    <#if scriptsEnabled>
        <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.AVATAR_URL = '${config.security.api.avatarUrl}';
            window.ROUTES = ${mapper.valueToTree(Routes.getJsRoutes())};
            window.ROUTES.parse = function (key, ...params) {
@ -147,9 +150,11 @@ showFooter: Boolean = true, noContainer: Boolean = false, additionalMeta: Html =
                }
                return route;
            };
+            </#outputformat>
        </script>
        <#if _csrf?? && _csrf.token??>
            <script nonce="${nonce}">
+                <#outputformat "JavaScript">
                window.csrf = '${_csrf.token}';
                window.csrfInfo = {
                    'parameterName': '${_csrf.parameterName}',
@ -158,14 +163,15 @@ showFooter: Boolean = true, noContainer: Boolean = false, additionalMeta: Html =
                };
                window.ajaxSettings = {"headers": { '${_csrf.headerName}': window.csrf}};
                window.isLoggedIn = ${headerData.hasUser()?c};
+                </#outputformat>
            </script>
        </#if>

-        <script type="text/javascript" src="<@hangar.url "js/chunk-vendors.js" />"></script>
-        <script type="text/javascript" src="<@hangar.url "js/chunk-common.js" />"></script>
-        <script type="text/javascript" src="<@hangar.url "js/font-awesome.js" />"></script>
-        <script type="text/javascript" src="<@hangar.url "js/bootstrap.js" />"></script>
-        <script type="text/javascript" src="<@hangar.url "js/main.js" />"></script>
+        <script type="text/javascript" src="${hangar.url("js/chunk-vendors.js")}"></script>
+        <script type="text/javascript" src="${hangar.url("js/chunk-common.js")}"></script>
+        <script type="text/javascript" src="${hangar.url("js/font-awesome.js")}"></script>
+        <script type="text/javascript" src="${hangar.url("js/bootstrap.js")}"></script>
+        <script type="text/javascript" src="${hangar.url("js/main.js")}"></script>
        ${additionalScripts}
    </#if>

--- a/src/main/resources/templates/layout/header.ftlh
+++ b/src/main/resources/templates/layout/header.ftlh
@ -31,7 +31,7 @@
                                <i class="fa-fw fas fa-graduation-cap"></i><@spring.message "general.javadocs" />
                            </a></li>
                        <li class="active"><a href="${Routes.SHOW_HOME.getRouteUrl()}">
-                                <img src="<@hangar.url "images/ore-nav.svg" />" alt=""
+                                <img src="${hangar.url("images/ore-nav.svg")}" alt=""
                                     class="fa-fw ore-nav"><@spring.message "general.plugins" />
                                (<@spring.message "general.appName" />)
                            </a></li>
--- a/src/main/resources/templates/projects/admin/notes.ftlh
+++ b/src/main/resources/templates/projects/admin/notes.ftlh
@ -3,8 +3,12 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <script <#--@CSPNonce.attr--> type="text/javascript" src="<@hangar.url "js/showNotes.js" />"></script>
-    <script<#--@CSPNonce.attr-->> window.resourcePath = '${project.ownerName}/${project.slug}'</script>
+    <script nonce="${nonce}" type="text/javascript" src="${hangar.url("js/showNotes.js")}"></script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
+        window.resourcePath = '${project.ownerName}/${project.slug}'
+        </#outputformat>
+    </script>
 </#assign>

 <#assign message><@spring.message "notes" /></#assign>
--- a/src/main/resources/templates/projects/channels/list.ftlh
+++ b/src/main/resources/templates/projects/channels/list.ftlh
@ -6,17 +6,19 @@
 <#import "*/utils/csrf.ftlh" as csrf>

 <#assign scriptsVar>
-    <script <#--@CSPNonce.attr-->>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.OWNER_NAME = '${p.project.ownerName}';
        window.PROJECT_SLUG = '${p.project.slug}';
        window.COLORS = ${mapper.valueToTree(@helper["io.papermc.hangar.model.Color"].getNonTransparentValues())};
        window.MAX_CHANNEL_NAME_LEN = ${config.channels.maxNameLen};
        window.CHANNELS = ${mapper.valueToTree(channels)};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/release-channels.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/release-channels.js")}"></script>
 </#assign>
 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/release-channels.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/release-channels.css")}">
 </#assign>

 <#assign message><@spring.messageArgs code="channel.list.title" args=[p.project.ownerName, p.project.slug] /></#assign>
--- a/src/main/resources/templates/projects/create.ftlh
+++ b/src/main/resources/templates/projects/create.ftlh
@ -7,13 +7,15 @@ Page used for uploading and creating new projects.
 -->
 <#assign scriptsVar>
    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.CURRENT_USER = ${mapper.valueToTree(cu)};
        window.ORGANIZAITONS = ${mapper.valueToTree(createProjectOrgas)};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/create-project.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/create-project.js")}"></script>
 </#assign>
 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/create-project.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/create-project.css")}">
 </#assign>

 <#assign message><@spring.message "project.create" /></#assign>
--- a/src/main/resources/templates/projects/discuss.ftlh
+++ b/src/main/resources/templates/projects/discuss.ftlh
@ -9,18 +9,22 @@ Discussion page within Project overview.

 <#-- todo: Bridge to Paper Discourse page? Directly save discussion in Hangar? -->
 <#assign scriptsVar>
-    <script <#--@CSPNonce.attr-->>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.DiscourseEmbed = {
            discourseUrl: '${config.app.discourseUrl}/',
            topicId: ${p.project.topicId}
        };
+        </#outputformat>
    </script>
-    <script <#--@CSPNonce.attr-->>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.buttonClick = function() {
            document.getElementsByClassName('btn.edit')[0].click();
        }
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/projectDiscuss.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/projectDiscuss.js")}"></script>
 </#assign>

 <@view.view p=p sp=sp active="#discussion" additionalScripts=scriptsVar>
--- a/src/main/resources/templates/projects/pages/modalPageCreate.ftlh
+++ b/src/main/resources/templates/projects/pages/modalPageCreate.ftlh
@ -3,9 +3,11 @@
 <#import "*/utils/csrf.ftlh" as csrf />

 <#macro pageCreate project, rootPages>
-    <script <#--@CSPNonce.attr-->>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        PROJECT_OWNER = '${project.ownerName}';
        PROJECT_SLUG = '${project.slug}';
+        </#outputformat>
    </script>

    <div class="modal fade" id="new-page" tabindex="-1" role="dialog" aria-labelledby="new-page-label">
--- a/src/main/resources/templates/projects/pages/view.ftlh
+++ b/src/main/resources/templates/projects/pages/view.ftlh
@ -15,7 +15,8 @@ Documentation page within Project overview.
 <#assign Permission=@helper["io.papermc.hangar.model.Permission"]>

 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.PAGE = ${mapper.valueToTree(projectPage)};
        window.ROOT_PAGES = ${utils.serializeMap(rootPages)};
        window.PAGE_COUNT = ${pageCount};
@ -23,19 +24,20 @@ Documentation page within Project overview.

        window.FILTERED_MEMBERS = ${utils.serializeMap(p.filteredMembers(headerData))};
        window.CAN_MANAGE_MEMBERS = ${sp.permissions.has(Permission.ManageSubjectMembers)?c};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/project-view.js" />"></script>
+    <script nonce="${nonce}" type="text/javascript" src="${hangar.url("js/project-view.js")}"></script>
 </#assign>

 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/project-view.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/project-view.css")}">
 </#assign>

 <@projectView.view p=p sp=sp active="#docs" additionalScripts=scriptsVar additionalStyling=styleVar>
    <div id="project-view">
        <div class="row">
            <div class="col-lg-8 col-12">
-                <div class="page-preview page-rendered">${markdownService.render(projectPage.contents)}</div>
+                <div class="page-preview page-rendered"><#outputformat "plainText">${markdownService.render(projectPage.contents)}</#outputformat></div>
            </div>
            <div class="col-lg-4 col-12">
                <@memberList.memberList project=p perms=sp.permissions settingsCall=Routes.PROJECTS_SHOW_SETTINGS.getRouteUrl(p.project.ownerName, p.project.slug) />
--- a/src/main/resources/templates/projects/settings.ftlh
+++ b/src/main/resources/templates/projects/settings.ftlh
@ -11,7 +11,8 @@
 <#assign Permission=@helper["io.papermc.hangar.model.Permission"] />
 <#assign Role=@helper["io.papermc.hangar.model.Role"] />
 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.PROJECT = ${mapper.valueToTree(p)};
        window.DEPLOYMENT_KEY = ${mapper.valueToTree(deploymentKey)};

@ -25,11 +26,12 @@
        }
        window.POSSIBLE_ROLES = ${mapper.valueToTree(Role.values()?filter(role -> role.category == p.roleCategory && role.isAssignable())?sort_by("permissions")?reverse)};
        window.PROJECT_OWNER_PERM = ${Permission.IsSubjectOwner.value};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/project-settings.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/project-settings.js")}"></script>
 </#assign>
 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/project-settings.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/project-settings.css")}">
 </#assign>

 <@projects.view p=p sp=sp active="#settings" additionalScripts=scriptsVar additionalStyling=styleVar>
--- a/src/main/resources/templates/projects/versions/create.ftlh
+++ b/src/main/resources/templates/projects/versions/create.ftlh
@ -11,7 +11,8 @@
 <#assign mainWidth = "col-md-10">

 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+            <#outputformat "JavaScript">
             window.OWNER_NAME = '${ownerName}';
             window.PROJECT_SLUG = '${projectSlug}';
             window.PENDING_VERSION = ${mapper.valueToTree(pending)};
@ -19,11 +20,12 @@
             window.FORUM_SYNC = ${forumSync?c};
             window.MAX_CHANNEL_NAME_LEN = ${config.channels.maxNameLen};
             window.COLORS = ${mapper.valueToTree(@helper["io.papermc.hangar.model.Color"].getNonTransparentValues())};
+             </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/create-version.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/create-version.js")}"></script>
 </#assign>
 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/create-version.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/create-version.css")}">
 </#assign>

 <#assign message><@spring.message "version.create.pageTitle" /></#assign>
--- a/src/main/resources/templates/projects/versions/list.ftlh
+++ b/src/main/resources/templates/projects/versions/list.ftlh
@ -7,18 +7,20 @@ Versions page within Project overview.
 -->
 <#assign Permission=@helper["io.papermc.hangar.model.Permission"]>
 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.PROJECT_OWNER = '${p.project.ownerName}';
            window.PROJECT_SLUG = '${p.project.slug}';
            window.CHANNELS = ${mapper.valueToTree(channels)};
            window.CAN_EDIT_CHANNELS = ${sp.perms(Permission.EditTags)?c};
            window.FILTERED_MEMBERS = ${utils.serializeMap(p.filteredMembers(headerData))};
            window.CAN_MANAGE_MEMBERS = ${sp.permissions.has(Permission.ManageSubjectMembers)?c};
+            </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/version-list-view.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/version-list-view.js")}"></script>
 </#assign>
 <#assign stylesheetsVar>
-    <link rel="stylesheet" type="text/css" href="<@hangar.url "css/version-list-view.css" />" />
+    <link rel="stylesheet" type="text/css" href="${hangar.url("css/version-list-view.css")}" />
 </#assign>
 <@projects.view p=p sp=sp active="#versions" additionalScripts=scriptsVar additionalStyling=stylesheetsVar>
    <div id="version-list-view">
--- a/src/main/resources/templates/projects/versions/view.ftlh
+++ b/src/main/resources/templates/projects/versions/view.ftlh
@ -9,10 +9,12 @@
 <#assign Permission=@helper["io.papermc.hangar.model.Permission"] />
 <#assign Visibility=@helper["io.papermc.hangar.model.Visibility"] />
 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.VERSION = ${mapper.valueToTree(v.v)};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/version-view.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/version-view.js")}"></script>
 </#assign>
 <@projects.view p=v.p sp=sp active="#versions" noButtons=true additionalScripts=scriptsVar>
    <!-- Version header -->
--- a/src/main/resources/templates/projects/view.ftlh
+++ b/src/main/resources/templates/projects/view.ftlh
@ -13,16 +13,18 @@ Base template for Project overview.
 <#-- @ftlvariable name="p" type="io.papermc.hangar.model.viewhelpers.ProjectData" -->
 <#-- @ftlvariable name="sp" type="io.papermc.hangar.model.viewhelpers.ScopedProjectData" -->
    <#assign scriptsVar>
-        <script <#-- @CSPNonce.attr -->>
+        <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.PROJECT = ${mapper.valueToTree(p.project)};
            window.CAN_EDIT_PAGES = ${sp.perms(Permission.EditPage)?c};
+            </#outputformat>
        </script>
-        <script type="text/javascript" src="<@hangar.url "js/project-controls.js" />"></script>
+        <script type="text/javascript" src="${hangar.url("js/project-controls.js")}"></script>
        ${additionalScripts}
    </#assign>

    <#assign styleVar>
-        <link rel="stylesheet" href="<@hangar.url "css/project-controls.css" />">
+        <link rel="stylesheet" href="${hangar.url("css/project-controls.css")}">
        ${additionalStyling}
    </#assign>

@ -184,40 +186,40 @@ Base template for Project overview.
                                </#if>

                                <#if p.project.homepage??>
-                                    <#assign homepage>${p.project.homepage}</#assign> <#-- move these assigns? -->
+                                    <#assign homepage=p.project.homepage />
                                    <li id="homepage" class="nav-item">
                                        <a title="${homepage}" target="_blank" rel="noopener"
-                                           href="<@hangar.linkout homepage/>" class="nav-link">
+                                           href="${hangar.linkout(homepage)}" class="nav-link">
                                            <i class="fas fa-home"></i> Homepage <i
                                                    class="fas fa-external-link-alt"></i></a>
                                    </li>
                                </#if>

                                <#if p.project.issues??>
-                                    <#assign issues>${p.project.issues}</#assign>
+                                    <#assign issues=p.project.issues />
                                    <li id="issues" class="nav-item">
                                        <a title="${issues}" target="_blank" rel="noopener"
-                                           href="<@hangar.linkout issues/>" class="nav-link">
+                                           href="${hangar.linkout(issues)}" class="nav-link">
                                            <i class="fas fa-bug"></i> Issues <i
                                                    class="fas fa-external-link-alt"></i></a>
                                    </li>
                                </#if>

                                <#if p.project.source??>
-                                    <#assign source>${p.project.source}</#assign>
+                                    <#assign source=p.project.source />
                                    <li id="source" class="nav-item">
                                        <a title="${source}" target="_blank" rel="noopener"
-                                           href="<@hangar.linkout source/>" class="nav-link">
+                                           href="${hangar.linkout(source)}" class="nav-link">
                                            <i class="fas fa-code"></i> Source <i class="fas fa-external-link-alt"></i>
                                        </a>
                                    </li>
                                </#if>

                                <#if p.project.support??>
-                                    <#assign support>${p.project.support}</#assign>
+                                    <#assign support=p.project.support />
                                    <li id="support" class="nav-item">
                                        <a title="${support}" target="_blank" rel="noopener"
-                                           href="<@hangar.linkout support/>" class="nav-link">
+                                           href="${hangar.linkout(support)}" class="nav-link">
                                            <i class="fas fa-question-circle"></i> Support <i
                                                    class="fas fa-external-link-alt"></i>
                                        </a>
--- a/src/main/resources/templates/swagger.ftlh
+++ b/src/main/resources/templates/swagger.ftlh
@ -7,10 +7,10 @@ Mostly copied from swagger-ui's index file
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <script type="text/javascript" src="<@hangar.url "js/swagger.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/swagger.js")}"></script>
 </#assign>
 <#assign styleVar>
-    <link rel="stylesheet" type="text/css" href="<@hangar.url "css/swagger.css" />">
+    <link rel="stylesheet" type="text/css" href="${hangar.url("css/swagger.css")}">
 </#assign>

 <#assign message><@spring.message "general.openapi" /></#assign>
--- a/src/main/resources/templates/users/admin/flags.ftlh
+++ b/src/main/resources/templates/users/admin/flags.ftlh
@ -4,8 +4,8 @@
 <#import "*/projects/helper/btnHide.ftlh" as hide />

 <#assign scriptsVar>
-    <script type="text/javascript" src="<@hangar.url "js/adminFlags.js" />"></script>
-    <script type="text/javascript" src="<@hangar.url "js/hideProject.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/adminFlags.js")}"></script>
+    <script type="text/javascript" src="${hangar.url("js/hideProject.js")}"></script>
 </#assign>

 <@base.base title="Flags" additionalScripts=scriptsVar>
--- a/src/main/resources/templates/users/admin/log.ftlh
+++ b/src/main/resources/templates/users/admin/log.ftlh
@ -3,7 +3,7 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <script type="text/javascript" src="<@hangar.url "js/actionLog.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/actionLog.js")}"></script>
 </#assign>

 <#assign message><@spring.message "admin.log.title" /></#assign>
--- a/src/main/resources/templates/users/admin/platformVersions.ftlh
+++ b/src/main/resources/templates/users/admin/platformVersions.ftlh
@ -5,11 +5,13 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <link rel="stylesheet" href="<@hangar.url "css/platform-version-table.css" />">
-    <script>
+    <link rel="stylesheet" href="${hangar.url("css/platform-version-table.css")}">
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.PLATFORMS = ${platformVersions}
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/platform-version-table.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/platform-version-table.js")}"></script>
 </#assign>

 <#assign message><@spring.message "admin.platformVersions.title" /></#assign>
--- a/src/main/resources/templates/users/admin/queue.ftlh
+++ b/src/main/resources/templates/users/admin/queue.ftlh
@ -3,10 +3,12 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.MAX_REVIEW_TIME = ${config.queue.maxReviewTime.toMillis()};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/queue.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/queue.js")}"></script>
 </#assign>

 <#assign message><@spring.message "user.queue" /></#assign>
--- a/src/main/resources/templates/users/admin/reviews.ftlh
+++ b/src/main/resources/templates/users/admin/reviews.ftlh
@ -3,8 +3,12 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scripts>
-    <script <#--@CSPNonce.attr--> type="text/javascript" src="<@hangar.url "js/review.js" />"></script>
-    <script <#--@CSPNonce.attr-->>window.versionPath = '${utils.urlEncode(project.project.ownerName)}/${utils.urlEncode(project.project.slug)}/versions/${utils.urlEncode(version.v.versionString)}'</script>
+    <script nonce="${nonce}" type="text/javascript" src="${hangar.url("js/review.js")}"></script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
+        window.versionPath = '${utils.urlEncode(project.project.ownerName)}/${utils.urlEncode(project.project.slug)}/versions/${utils.urlEncode(version.v.versionString)}'
+        </#outputformat>
+    </script>
 </#assign>

 <#assign ReviewState=@helper["io.papermc.hangar.model.generated.ReviewState"] />
--- a/src/main/resources/templates/users/admin/stats.ftlh
+++ b/src/main/resources/templates/users/admin/stats.ftlh
@ -3,7 +3,8 @@
 <#import "*/layout/base.ftlh" as base />

 <#assign scriptsVar>
-    <script <#--@CSPNonce.attr-->>
+    <script nonce="${nonce}">
+      <#outputformat "JavaScript">
      window.DAYS = ${days};
      window.REVIEW_DATA = ${reviewData};
      window.UPLOAD_DATA = ${uploadData};
@ -16,8 +17,9 @@
          FROM: '${@helper["java.time.LocalDate"].now().minus(1, @helper["java.time.temporal.ChronoUnit"].DAYS)}',
          TO: '${@helper["java.time.LocalDate"].now()}',
      };
+      </#outputformat>
    </script>
-    <script <#--@CSPNonce.attr--> type="text/javascript" src="<@hangar.url "js/stats.js" />"></script>
+    <script nonce="${nonce}" type="text/javascript" src="${hangar.url("js/stats.js")}"></script>
 </#assign>

 <@base.base title="Stats" additionalScripts=scriptsVar>
--- a/src/main/resources/templates/users/admin/userAdmin.ftlh
+++ b/src/main/resources/templates/users/admin/userAdmin.ftlh
@ -12,7 +12,8 @@
 <#assign projectRoles=Role.values()?filter(role -> role.category == RoleCategory.PROJECT) />

 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.IS_ORGANIZATION = ${u.isOrga()?c};
        window.ROLES = {
            <#if u.isOrga()>
@ -28,8 +29,9 @@
            </#if>
            ORGANIZATION: ${mapper.valueToTree(orgRoles)},
        }
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/user-admin.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/user-admin.js")}"></script>
 </#assign>

 <@base.base title=(prefix + u.user.name) additionalScripts=scriptsVar>
--- a/src/main/resources/templates/users/admin/visibility.ftlh
+++ b/src/main/resources/templates/users/admin/visibility.ftlh
@ -39,7 +39,7 @@
 </#macro>

 <#assign scriptsVar>
-    <script type="text/javascript" src="<@hangar.url "js/hideProject.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/hideProject.js")}"></script>
 </#assign>

 <@base.base title="Project Visibility" additionalScripts=scriptsVar>
--- a/src/main/resources/templates/users/apiKeys.ftlh
+++ b/src/main/resources/templates/users/apiKeys.ftlh
@ -4,10 +4,12 @@

 <#assign scriptsVar>
    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.API_KEY_PERMISSIONS = ${mapper.valueToTree(perms)};
        window.EXISTING_KEYS = ${mapper.valueToTree(keys)};
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/api-key-management.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/api-key-management.js")}"></script>
 </#assign>

 <#assign NamedPermission=@helper["io.papermc.hangar.model.NamedPermission"] />
--- a/src/main/resources/templates/users/authors.ftlh
+++ b/src/main/resources/templates/users/authors.ftlh
@ -37,8 +37,12 @@
 </#function>

 <#assign scriptsVar>
-    <script <#--@CSPNonce.attr-->>window.CURRENT_PAGE = ${page};</script>
-	<script type="text/javascript" src="<@hangar.url "js/userList.js" />"></script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
+        window.CURRENT_PAGE = ${page};
+        </#outputformat>
+    </script>
+	<script type="text/javascript" src="${hangar.url("js/userList.js")}"></script>
 </#assign>

 <#-- @ftlvariable name="page" type="java.lang.Integer" -->
--- a/src/main/resources/templates/users/notifications.ftlh
+++ b/src/main/resources/templates/users/notifications.ftlh
@ -8,7 +8,8 @@
 <#assign NotificationFilter=@helper["io.papermc.hangar.model.NotificationFilter"] />
 <#assign InviteFilter=@helper["io.papermc.hangar.model.InviteFilter"] />
 <#assign scriptsVar>
-    <script>
+    <script nonce="${nonce}">
+        <#outputformat "JavaScript">
        window.NOTIFICATION_FILTER = ${mapper.valueToTree(notificationFilter)};
        window.INVITE_FILTER = ${mapper.valueToTree(inviteFilter)};
        window.NOTIFICATIONS = ${utils.serializeMap(notifications)};
@ -18,12 +19,13 @@
            NOTIFICATIONS: ${mapper.valueToTree(NotificationFilter.getValues())},
            INVITES: ${mapper.valueToTree(InviteFilter.getValues())},
        };
+        </#outputformat>
    </script>
-    <script type="text/javascript" src="<@hangar.url "js/notifications.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/notifications.js")}"></script>
 </#assign>

 <#assign styleVar>
-    <link rel="stylesheet" href="<@hangar.url "css/notifications.css" />">
+    <link rel="stylesheet" href="${hangar.url("css/notifications.css")}">
 </#assign>

 <#assign message><@spring.message "notification.plural" /></#assign>
--- a/src/main/resources/templates/users/projects.ftlh
+++ b/src/main/resources/templates/users/projects.ftlh
@ -11,29 +11,33 @@
 </#function>

 <#assign scriptsVar>
-    <script type="text/javascript" src="<@hangar.url "js/user-profile.js" />"></script>
+    <script type="text/javascript" src="${hangar.url("js/user-profile.js")}"></script>
    <#if u.isOrga()>
-        <script>
+        <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.JOINABLE_NAME = '${o.get().org.name}';
            window.CAN_MANAGE_MEMBERS = ${so.get().permissions.has(Permission.ManageSubjectMembers)?c};
            window.ORG_OWNER_PERM = ${Permission.IsOrganizationOwner.value?c};
            window.FILTERED_MEMBERS = ${utils.serializeMap(o.get().filteredMembers(headerData))};
+            </#outputformat>
        </script>
        <#if o.present && canEditOrgMembers()>
-            <script>
+            <script nonce="${nonce}">
+                <#outputformat "JavaScript">
                window.POSSIBLE_ROLES = ${mapper.valueToTree(Role.values()?filter(role -> role.category == o.get().roleCategory && role.isAssignable())?sort_by("permissions")?reverse)};

                window.ORG_NAME = '${u.user.name}';
                window.PROJECT_ROLES = ${utils.serializeMap(o.get().projectRoles)};
+                </#outputformat>
            </script>
        </#if>
-        <script type="text/javascript" src="<@hangar.url "js/org-sidebar.js" />"></script>
+        <script type="text/javascript" src="${hangar.url("js/org-sidebar.js")}"></script>
    </#if>
 </#assign>

 <#assign styleVar>
    <#if u.isOrga()>
-        <link rel="stylesheet" href="<@hangar.url "css/org-sidebar.css" />">
+        <link rel="stylesheet" href="${hangar.url("css/org-sidebar.css")}">
    </#if>
 </#assign>

--- a/src/main/resources/templates/users/staff.ftlh
+++ b/src/main/resources/templates/users/staff.ftlh
@ -19,8 +19,12 @@
 </#function>

 <#assign scriptsVar>
-	<script <#--@CSPNonce.attr-->>window.CURRENT_PAGE = ${page};</script>
-	<script type="text/javascript" src="<@hangar.url "js/userList.js" />"></script>
+	<script nonce="${nonce}">
+        <#outputformat "JavaScript">
+        window.CURRENT_PAGE = ${page};
+        </#outputformat>
+    </script>
+	<script type="text/javascript" src="${hangar.url("js/userList.js")}"></script>
 </#assign>

 <@base.base title="Staff - Hangar" additionalScripts=scriptsVar>
--- a/src/main/resources/templates/users/view.ftlh
+++ b/src/main/resources/templates/users/view.ftlh
@ -24,7 +24,8 @@
    <#-- @ftlvariable name="Permission" type="io.papermc.hangar.model.Permission" -->
    <#assign Permission=@helper["io.papermc.hangar.model.Permission"]>
    <#assign scriptsVar>
-        <script <#-- @CSPNonce.attr -->>
+        <script nonce="${nonce}">
+            <#outputformat "JavaScript">
            window.USERNAME = '${u.user.name}';
            window.NO_ACTION_MESSAGE = {};
            window.CATEGORY_TITLE = {};
@ -36,8 +37,9 @@
            </#list>
            window.NO_ACTION_MESSAGE.starred = '<@spring.messageArgs code="user.noStars" args=[u.user.name] />';
            window.NO_ACTION_MESSAGE.watching = '<@spring.messageArgs code="user.noWatching" args=[u.user.name] />';
+            </#outputformat>
        </script>
-        <script type="text/javascript" src="<@hangar.url "js/userPage.js" />"></script>
+        <script type="text/javascript" src="${hangar.url("js/userPage.js")}"></script>
        ${additionalScripts}
    </#assign>

@ -147,16 +149,7 @@

        <#nested />

-        <#assign lockModalTitle>
-            <#compress>
-                <#if u.user.isLocked()>
-                    user.unlock
-                <#else>
-                    user.lock
-                </#if>
-            </#compress>
-        </#assign>
-        <@modal.modal lockModalTitle "modal-lock" "label-lock">
+        <@modal.modal lockModalTitle() "modal-lock" "label-lock">
            <div class="modal-body">
                <p class="minor">
                    <#if u.user.isLocked()>
@ -201,3 +194,11 @@
        </@modal.modal>
    </@base.base>
 </#macro>
+
+<#function lockModalTitle>
+    <#if u.user.isLocked()>
+        <#return "user.unlock">
+    <#else>
+        <#return "user.lock">
+    </#if>
+</#function>
--- a/src/main/resources/templates/utils/hangar.ftlh
+++ b/src/main/resources/templates/utils/hangar.ftlh
@ -1,13 +1,11 @@
-<#macro linkout url>
-    ${config.security.makeSafe(url)}
-</#macro>
+<#function linkout url>
+   <#return config.security.makeSafe(url)>
+</#function>

-<#macro url path>
-    <#compress>
-        <#if config.useWebpack>
-            http://localhost:8081/${path}
-        <#else>
-            ${urls.getForLookupPath('/assets/${path}')!"/assets/${path}?error"}
-        </#if>
-    </#compress>
-</#macro>
+<#function url path>
+    <#if config.useWebpack>
+        <#return 'http://localhost:8081/${path}'>
+    <#else>
+        <#return urls.getForLookupPath("/assets/${path}")!"/assets/${path}?error">
+    </#if>
+</#function>