From d3b9599421a2ac21ce4acf90a7dad17efb1b0019 Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Mon, 29 Jun 2026 19:26:01 +0000
Subject: [PATCH] csp script nonce

---
 contrib/plugins/minimal-up2k.js |  5 +++-
 copyparty/__init__.py           |  1 -
 copyparty/__main__.py           |  6 ++--
 copyparty/authsrv.py            | 13 ++++++---
 copyparty/cfg.py                |  4 +++
 copyparty/httpcli.py            | 18 ++++++++----
 copyparty/web/browser.html      | 17 ++++++-----
 copyparty/web/browser.js        | 37 +++++++++++++++--------
 copyparty/web/cf.html           |  2 +-
 copyparty/web/idp.html          |  9 +++---
 copyparty/web/md.html           | 15 +++++-----
 copyparty/web/mde.html          | 15 +++++-----
 copyparty/web/msg.html          |  6 ++--
 copyparty/web/rups.html         | 13 +++++----
 copyparty/web/shares.html       | 11 +++----
 copyparty/web/splash.html       | 20 ++++++++-----
 copyparty/web/svcs.html         | 11 +++----
 copyparty/web/tl/chi.js         |  2 +-
 copyparty/web/tl/cze.js         |  2 +-
 copyparty/web/tl/deu.js         |  2 +-
 copyparty/web/tl/epo.js         |  2 +-
 copyparty/web/tl/fin.js         |  2 +-
 copyparty/web/tl/fra.js         |  2 +-
 copyparty/web/tl/grc.js         |  2 +-
 copyparty/web/tl/hun.js         |  2 +-
 copyparty/web/tl/ita.js         |  2 +-
 copyparty/web/tl/jpn.js         |  2 +-
 copyparty/web/tl/kor.js         |  2 +-
 copyparty/web/tl/nld.js         |  2 +-
 copyparty/web/tl/nno.js         |  2 +-
 copyparty/web/tl/nor.js         |  2 +-
 copyparty/web/tl/pol.js         |  2 +-
 copyparty/web/tl/por.js         |  2 +-
 copyparty/web/tl/rus.js         |  2 +-
 copyparty/web/tl/spa.js         |  2 +-
 copyparty/web/tl/swe.js         |  2 +-
 copyparty/web/tl/tur.js         |  2 +-
 copyparty/web/tl/ukr.js         |  2 +-
 copyparty/web/tl/vie.js         |  2 +-
 copyparty/web/up2k.js           | 52 +++++++++++++++++++++++----------
 copyparty/web/util.js           | 19 +++++++++---
 copyparty/web/w.hash.js         | 15 +++++-----
 scripts/deps-docker/Dockerfile  |  4 ++-
 scripts/make-sfx.sh             | 25 ++++++++++++++--
 scripts/sfx.ls                  |  1 -
 scripts/tl.js                   |  2 +-
 tests/util.py                   |  4 +--
 47 files changed, 235 insertions(+), 134 deletions(-)

diff --git a/contrib/plugins/minimal-up2k.js b/contrib/plugins/minimal-up2k.js
index b3514aea..e3defcd8 100644
--- a/contrib/plugins/minimal-up2k.js
+++ b/contrib/plugins/minimal-up2k.js
@@ -66,11 +66,14 @@ var u2min = `
 
 </style>
 
-<a href="#" onclick="this.parentNode.innerHTML='';">show advanced options</a>
+<a href="#" id="u2min_off">show advanced options</a>
 `;
 
 if (!has(perms, 'read')) {
   var e2 = mknod('div');
   e2.innerHTML = u2min;
   ebi('wrap').insertBefore(e2, QS('#wfp'));
+  ebi('u2min_off').onclick = function () {
+    this.parentNode.innerHTML='';
+  };
 }
diff --git a/copyparty/__init__.py b/copyparty/__init__.py
index 6430e655..6756b8b5 100644
--- a/copyparty/__init__.py
+++ b/copyparty/__init__.py
@@ -135,7 +135,6 @@ web/tl/vie.js
 web/ui.css
 web/up2k.js
 web/util.js
-web/w.hash.js
 """
 RES = set(zs.strip().split("\n"))
 RESM = {
diff --git a/copyparty/__main__.py b/copyparty/__main__.py
index 7fdb81ec..af0df4af 100644
--- a/copyparty/__main__.py
+++ b/copyparty/__main__.py
@@ -1681,7 +1681,9 @@ def add_safety(ap):
     ap2.add_argument("--no-dot-ren", action="store_true", help="disallow renaming dotfiles; makes it impossible to turn something into a dotfile")
     ap2.add_argument("--no-logues", action="store_true", help="disable rendering .prologue/.epilogue.html into directory listings")
     ap2.add_argument("--no-readme", action="store_true", help="disable rendering readme/preadme.md into directory listings")
-    ap2.add_argument("--no-script", action="store_true", help="disables javascript in html files; helps prevent XSS but kills interactive websites (volflag=noscript)")
+    ap2.add_argument("--csp-ui", metavar="TXT", default="script-src 'unsafe-eval' 'nonce-{{ js_nonce }}'; worker-src 'self'", help="content-security-policy to apply for the web-UI; default helps prevent XSS by blocking <script> / onclick / ... (volflag=csp_ui)")
+    ap2.add_argument("--csp-dl", metavar="TXT", default="", help="content-security-policy to apply for static files (volflag=csp_dl)")
+    ap2.add_argument("--no-script", action="store_true", help="disables javascript in html files; helps prevent XSS but kills interactive websites; this will override \033[33m--csp-dl\033[0m with [\033[32mscript-src 'none'\033[0m] (volflag=noscript)")
     ap2.add_argument("--no-html", action="store_true", help="show html-files as plain text; helps prevent XSS but kills websites/blogs, also enables --no-script (volflag=nohtml)")
     ap2.add_argument("--vague-403", action="store_true", help="send 404 instead of 403 (security through ambiguity, very enterprise). \033[1;31mWARNING:\033[0m Not compatible with WebDAV")
     ap2.add_argument("--force-js", action="store_true", help="don't send folder listings as HTML, force clients to use the embedded json instead -- slight protection against misbehaving search engines which ignore \033[33m--no-robots\033[0m")
@@ -1961,7 +1963,7 @@ def add_ui(ap, retry: int):
     ap2.add_argument("--css-browser", metavar="L", type=u, default="", help="URL to additional CSS to include in the filebrowser html")
     ap2.add_argument("--js-browser", metavar="L", type=u, default="", help="URL to additional JS to include in the filebrowser html")
     ap2.add_argument("--js-other", metavar="L", type=u, default="", help="URL to additional JS to include in all other pages")
-    ap2.add_argument("--html-head", metavar="TXT", type=u, default="", help="text to append to the <head> of all HTML pages (except for basic-browser); can be @PATH to send the contents of a file at PATH, and/or begin with %% to render as jinja2 template (volflag=html_head)")
+    ap2.add_argument("--html-head", metavar="TXT", type=u, default="", help="text to append to the <head> of all HTML pages (except for basic-browser); can be @PATH to send the contents of a file at PATH, and/or begin with %% to render as jinja2 template; \033[32m<script>\033[0m will not work, use \033[32m<script nonce=\"{{ js_nonce }}\">\033[0m (volflag=html_head)")
     ap2.add_argument("--html-head-s", metavar="T", type=u, default="", help="text to append to the <head> of all HTML pages (except for basic-browser); similar to (and can be combined with) --html-head but only accepts static text (volflag=html_head_s)")
     ap2.add_argument("--ih", action="store_true", help="if a folder contains index.html, show that instead of the directory listing by default (can be changed in the client settings UI, or add ?v to URL for override)")
     ap2.add_argument("--textfiles", metavar="CSV", type=u, default="txt,nfo,diz,cue,readme", help="file extensions to present as plaintext")
diff --git a/copyparty/authsrv.py b/copyparty/authsrv.py
index 069ace85..08c39335 100644
--- a/copyparty/authsrv.py
+++ b/copyparty/authsrv.py
@@ -2641,17 +2641,22 @@ class AuthSrv(object):
             if head_s and not head_s.endswith("\n"):
                 head_s += "\n"
 
+            zs = vol.flags.get("csp_ui", "")
+            csp_ui = "Content-Security-Policy: %s\r\n" % (zs,) if zs else ""
+            zs = vol.flags.get("csp_dl", "")
+            csp_dl = "Content-Security-Policy: %s\r\n" % (zs,) if zs else ""
+
             zs = "X-Content-Type-Options: nosniff\r\n"
             if "norobots" in vol.flags:
                 head_s += META_NOBOTS
                 zs += "X-Robots-Tag: noindex, nofollow\r\n"
             if self.args.http_vary:
                 zs += "Vary: %s\r\n" % (self.args.http_vary,)
-            vol.flags["oh_g"] = zs + "\r\n"
+            vol.flags["oh_g"] = zs + csp_ui + "\r\n"
 
             if "noscript" in vol.flags:
-                zs += "Content-Security-Policy: script-src 'none';\r\n"
-            vol.flags["oh_f"] = zs + "\r\n"
+                csp_dl = "Content-Security-Policy: script-src 'none';\r\n"
+            vol.flags["oh_f"] = zs + csp_dl + "\r\n"
 
             ico_url = vol.flags.get("ufavico")
             if ico_url:
@@ -3288,7 +3293,7 @@ class AuthSrv(object):
                     js_htm[zs] = zs2
 
             zs = "have_emp md_no_br"
-            md_htm = {x:js_htm[x] for x in zs.split(" ")}
+            md_htm = {x: js_htm[x] for x in zs.split(" ")}
             md_htm["modpoll_freq"] = self.args.mcr
 
             vn.js_htm = json_hesc(json.dumps(js_htm))
diff --git a/copyparty/cfg.py b/copyparty/cfg.py
index 980e5a36..b519f645 100644
--- a/copyparty/cfg.py
+++ b/copyparty/cfg.py
@@ -105,6 +105,8 @@ def vf_vmap() -> dict[str, str]:
         "casechk",
         "chmod_d",
         "chmod_f",
+        "csp_ui",
+        "csp_dl",
         "dbd",
         "db_xattr",
         "du_who",
@@ -369,6 +371,8 @@ flagcats = {
         "lg_sbf": "list of *logue-sandbox safeguards to disable",
         "md_sba": "value of iframe allow-prop for markdown-sandbox",
         "lg_sba": "value of iframe allow-prop for *logue-sandbox",
+        "csp_ui": "content-security-policy for the web-UI",
+        "csp_dl": "content-security-policy for static files",
         "nohtml": "return html and markdown as text/html",
         "noscript": "disable most javascript by use of CSP",
         "ui_noacci": "hide account-info in the UI",
diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 521b785f..9e50fd97 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -63,6 +63,7 @@ from .util import (
     alltrace,
     atomic_move,
     b64dec,
+    b64enc,
     eol_conv,
     exclude_dotfiles,
     exclude_dotfiles_ls,
@@ -239,6 +240,7 @@ class HttpCli(object):
         self.gen_fk = self._gen_fk if self.args.log_fk else gen_filekey
         self.tls = self.is_https = hasattr(self.s, "cipher")
         self.is_vproxied = bool(self.args.R)
+        self.js_nonce = b64enc(os.urandom(16)).decode("ascii")
 
         # placeholders; assigned by run()
         self.keepalive = False
@@ -317,6 +319,7 @@ class HttpCli(object):
         ka["favico"] = self.args.favico
         ka["s_doctitle"] = self.args.doctitle
         ka["tcolor"] = self.vn.flags["tcolor"]
+        ka["js_nonce"] = self.js_nonce
 
         if self.args.js_other and "js" not in ka:
             zs = self.args.js_other
@@ -327,7 +330,7 @@ class HttpCli(object):
             ka["this"] = self
             self._build_html_head(ka)
 
-        ka["html_head"] = self.html_head
+        ka["html_head"] = self.html_head.replace("{{ js_nonce }}", self.js_nonce)
         return tpl.render(**ka)  # type: ignore
 
     def j2j(self, name: str) -> jinja2.Template:
@@ -789,9 +792,13 @@ class HttpCli(object):
                     self.pw = ""
                     self.uname = idp_usr
                     if self.args.ao_have_pw or self.args.idp_logout:
-                        self.html_head += "<script>var is_idp=1</script>\n"
+                        self.html_head += (
+                            '<script nonce="{{ js_nonce }}">var is_idp=1</script>\n'
+                        )
                     else:
-                        self.html_head += "<script>var is_idp=2</script>\n"
+                        self.html_head += (
+                            '<script nonce="{{ js_nonce }}">var is_idp=2</script>\n'
+                        )
                     zs = self.asrv.ases.get(idp_usr)
                     if zs:
                         self.set_idp_cookie(zs)
@@ -1115,7 +1122,7 @@ class HttpCli(object):
                 self.cbonk(self.conn.hsrv.gmal, zs, "cc_hdr", "Cc in out-hdr")
                 raise Pebkac(999)
 
-        response.append(self.vn.flags[oh_k])
+        response.append(self.vn.flags[oh_k].replace("{{ js_nonce }}", self.js_nonce))
 
         if self.args.ohead and self.do_log:
             zs = response.pop()[:-4]
@@ -5374,7 +5381,7 @@ class HttpCli(object):
         file_ts = int(max(ts_md, self.E.t0))
         file_lastmod, do_send, _ = self._chk_lastmod(file_ts)
         self.out_headers["Last-Modified"] = file_lastmod
-        self.out_headers["Cache-Control"] = "no-cache"
+        # default Cache-Control (no-store) due to csp nonce
         status = 200 if do_send else 304
 
         arg_base = "?"
@@ -5384,6 +5391,7 @@ class HttpCli(object):
         boundary = "\roll\tide"
         targs = {
             "r": self.args.SR if self.is_vproxied else "",
+            "js_nonce": self.js_nonce,
             "ts": self.conn.hsrv.cachebuster(),
             "edit": "edit" in self.uparam,
             "title": html_escape(self.vpath, crlf=True),
diff --git a/copyparty/web/browser.html b/copyparty/web/browser.html
index a5b412b0..61a37526 100644
--- a/copyparty/web/browser.html
+++ b/copyparty/web/browser.html
@@ -131,8 +131,9 @@
 
 	<div id="rcm" tabindex="0"></div>
 
-	<script>
+	<script nonce="{{ js_nonce }}">
 		var SR = "{{ r }}",
+			JS_NONCE = "{{ js_nonce }}",
 			CGV1 = {{ cgv1 }},
 			CGV = {{ cgv|tojson }},
 			TS = "{{ ts }}",
@@ -146,17 +147,17 @@
 		var STG = window.localStorage;
 		document.documentElement.className = (STG && STG.cpp_thm) || dtheme;
 	</script>
-	<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
 	{%- if lang != "eng" %}
-	<script src="{{ r }}/.cpr/w/tl/{{ lang }}.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/tl/{{ lang }}.js?_={{ ts }}"></script>
 	{%- endif %}
-	<script src="{{ r }}/.cpr/w/baguettebox.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/browser.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/up2k.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/baguettebox.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/browser.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/up2k.js?_={{ ts }}"></script>
 	{%- if js %}
-	<script src="{{ js }}_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 	{%- endif %}
-	<script>
+	<script nonce="{{ js_nonce }}">
 		Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 		jsldp("J_UTL","util");
 		jsldp("J_BBX","baguettebox");
diff --git a/copyparty/web/browser.js b/copyparty/web/browser.js
index ee71d781..2bd20230 100644
--- a/copyparty/web/browser.js
+++ b/copyparty/web/browser.js
@@ -579,7 +579,7 @@ if (1)
 		"u_https1": "you should",
 		"u_https2": "switch to https",
 		"u_https3": "for better performance",
-		"u_ancient": 'your browser is impressively ancient -- maybe you should <a href="#" onclick="goto(\'bup\')">use bup instead</a>',
+		"u_ancient": 'your browser is impressively ancient -- maybe you should <a href="#" id="u2nah">use bup instead</a>',
 		"u_nowork": "need firefox 53+ or chrome 57+ or iOS 11+",
 		"tail_2old": "need firefox 105+ or chrome 71+ or iOS 14.5+",
 		"u_nodrop": 'your browser is too old for drag-and-drop uploading',
@@ -865,7 +865,7 @@ ebi('widget').innerHTML = (
 
 // up2k ui
 ebi('op_up2k').innerHTML = (
-	'<form id="u2form" method="post" enctype="multipart/form-data" onsubmit="return false;"></form>\n' +
+	'<form id="u2form" method="post" enctype="multipart/form-data"></form>\n' +
 
 	'<table id="u2conf">\n' +
 	'	<tr>\n' +
@@ -944,6 +944,9 @@ ebi('op_up2k').innerHTML = (
 	'<div id="u2life"></div>' +
 	'<div id="u2foot"></div>'
 );
+ebi('u2form').onsubmit = function () {
+	return false;
+};
 
 
 ebi('wrap').insertBefore(mknod('div', 'lazy'), ebi('epi'));
@@ -1198,6 +1201,8 @@ function goto(dest) {
 	if (treectl)
 		treectl.onscroll();
 }
+function go2bup() { goto('bup'); }
+function go2up2k() { goto('up2k'); }
 
 
 var m = SPINNER.split(','),
@@ -4533,8 +4538,9 @@ var fileman = (function () {
 			}
 
 			var msg = esc(L.fr_busy.format(f.length, f[0].ofn));
-			msg += '\n<a id="fs_abrt" class="btn" href="#" onclick="fs_abrt()">' + L.fs_abrt + '</a>';
+			msg += '\n<a id="fs_abrt" class="btn" href="#">' + L.fs_abrt + '</a>';
 			toast.show('inf r', 0, msg);
+			ebi('fs_abrt').onclick = fs_abrt;
 			var dst = base + uricom_enc(f[0].inew.value, false);
 
 			function rename_cb() {
@@ -4861,8 +4867,9 @@ var fileman = (function () {
 				return paster();
 
 			var msg = esc((r.ccp ? L.fcp_busy : L.fp_busy).format(f.length + 1, uricom_dec(t.src)));
-			msg += '\n<a id="fs_abrt" class="btn" href="#" onclick="fs_abrt()">' + L.fs_abrt + '</a>';
+			msg += '\n<a id="fs_abrt" class="btn" href="#">' + L.fs_abrt + '</a>';
 			toast.show('inf r', 0, msg);
+			ebi('fs_abrt').onclick = fs_abrt;
 
 			var xhr = new XHR(),
 				act = r.ccp ? '?copy=' : '?move=',
@@ -5885,10 +5892,15 @@ var thegrid = (function () {
 
 			html.push('<a href="' + ohref + '" ref="' + ref +
 				'"' + ac + ' ttt="' + esc(name) + '"><img style="height:' +
-				(r.sz / 1.25) + 'em" loading="lazy" onload="th_onload(this)" src="' +
+				(r.sz / 1.25) + 'em" loading="lazy" fetchPriority="low" src="' +
 				ihref + '" /><span' + ac + '>' + ao.innerHTML + '</span></a>');
 		}
 		ggrid.innerHTML = html.join('\n');
+
+		var ths = QSA('#ggrid>a>img');
+		for (var a = 0, aa = ths.length; a < aa; a++)
+			ths[a].onload = th_onload;
+
 		clmod(ggrid, 'crop', r.crop);
 		clmod(ggrid, 'nocrop', !r.crop);
 
@@ -5899,7 +5911,7 @@ var thegrid = (function () {
 		if (srch && r.sel)
 			gsel.click();
 
-		var ths = QSA('#ggrid>a');
+		ths = QSA('#ggrid>a');
 		for (var a = 0, aa = ths.length; a < aa; a++) {
 			ths[a].ondblclick = gclick2;
 			ths[a].onclick = gclick1;
@@ -6040,8 +6052,8 @@ var thegrid = (function () {
 })();
 
 
-function th_onload(el) {
-	el.style.height = '';
+function th_onload() {
+	this.style.height = '';
 }
 
 
@@ -9118,7 +9130,7 @@ var sandboxjs = (function () {
 	var ret = '',
 		busy = false,
 		url = SR + '/.cpr/w/util.js?_=' + TS,
-		tag = '<script src="' + url + '"></script>';
+		tag = '<script nonce="' + JS_NONCE + '" src="' + url + '"></script>';
 
 	return function () {
 		if (ret || busy)
@@ -9128,7 +9140,7 @@ var sandboxjs = (function () {
 		xhr.open('GET', url, true);
 		xhr.onload = function () {
 			if (this.status == 200)
-				ret = '<script>' + this.responseText + '</script>';
+				ret = '<script nonce="' + JS_NONCE + '">' + this.responseText + '</script>';
 		};
 		xhr.send();
 		busy = true;
@@ -9276,8 +9288,9 @@ function sandbox(tgt, rules, allow, cls, html) {
 	html = '<html class="iframe ' + document.documentElement.className +
 		'"><head><style>html{background:#eee;color:#000}</style><style>' + globalcss() +
 		'</style><base target="_parent"></head><body id="b" class="logue ' + cls + '">' + html +
-		'<script>' + env + '</script>' + sandboxjs() +
-		'<script>var d=document.documentElement,TS="' + TS + '",' +
+		'<script nonce="' + JS_NONCE + '">' + env + '</script>' + sandboxjs() +
+		'<script nonce="' + JS_NONCE + '">' +
+		'var d=document.documentElement,TS="' + TS + '",' +
 		'loc=new URL("' + location.href.split('?')[0] + '");' +
 		'function say(m){window.parent.postMessage(m,"*")};' +
 		'setTimeout(function(){var its=0,pih=-1,f=function(){' +
diff --git a/copyparty/web/cf.html b/copyparty/web/cf.html
index 8fca2c7a..add8e193 100644
--- a/copyparty/web/cf.html
+++ b/copyparty/web/cf.html
@@ -14,7 +14,7 @@
 		<p>sorry for the inconvenience</p>
 	</div>
 
-	<script>
+	<script nonce="{{ js_nonce }}">
 		setTimeout(function() {
 			document.getElementById('box').style.opacity = 1;
 		}, 500);
diff --git a/copyparty/web/idp.html b/copyparty/web/idp.html
index 13360181..51c62e21 100644
--- a/copyparty/web/idp.html
+++ b/copyparty/web/idp.html
@@ -36,9 +36,10 @@
         {%- endif %}
     </div>
 	<a href="#" id="repl">π</a>
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR="{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
 	lang="{{ lang }}",
 	dfavico="{{ favico }}";
 
@@ -46,11 +47,11 @@ var STG = window.localStorage;
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
 
 </script>
-<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
 {%- if js %}
-<script src="{{ js }}_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 {%- endif %}
-<script>
+<script nonce="{{ js_nonce }}">
     Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
     jsldp("J_UTL","util");
 </script>
diff --git a/copyparty/web/md.html b/copyparty/web/md.html
index 65deec1e..8913b5c4 100644
--- a/copyparty/web/md.html
+++ b/copyparty/web/md.html
@@ -131,9 +131,10 @@ write markdown (most html is 🙆 too)
 	</div>
 	{%- endif %}
 
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR = "{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
 	CGV1 = {{ cgv1 }},
 	last_modified = {{ lastmod }},
 	dfavico = "{{ favico }}";
@@ -153,13 +154,13 @@ try { l.light = drk? 0:1; } catch (ex) { }
 })();
 
 	</script>
-	<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/deps/marked.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/md.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/deps/marked.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/md.js?_={{ ts }}"></script>
 	{%- if edit %}
-	<script src="{{ r }}/.cpr/w/md2.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/md2.js?_={{ ts }}"></script>
 	{%- endif %}
-	<script>
+	<script nonce="{{ js_nonce }}">
 		Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 		jsldp("J_UTL","util");
 		jsldp("J_MD","md");
@@ -168,7 +169,7 @@ try { l.light = drk? 0:1; } catch (ex) { }
 		{%- endif %}
 	</script>
 	{%- if js %}
-	<script src="{{ js }}_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 	{%- endif %}
 </body>
 </html>
diff --git a/copyparty/web/mde.html b/copyparty/web/mde.html
index 1065e74d..80909653 100644
--- a/copyparty/web/mde.html
+++ b/copyparty/web/mde.html
@@ -28,9 +28,10 @@
 		</div>
 	</div>
 	<a href="#" id="repl">π</a>
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR = "{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
 	CGV1 = {{ cgv1 }},
 	last_modified = {{ lastmod }},
 	dfavico = "{{ favico }}";
@@ -48,14 +49,14 @@ try { l.light = drk? 0:1; } catch (ex) { }
 })();
 
 	</script>
-	<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/deps/marked.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/deps/easymde.js?_={{ ts }}"></script>
-	<script src="{{ r }}/.cpr/w/mde.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/deps/marked.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/deps/easymde.js?_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/mde.js?_={{ ts }}"></script>
 	{%- if js %}
-	<script src="{{ js }}_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 	{%- endif %}
-	<script>
+	<script nonce="{{ js_nonce }}">
 		Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 		jsldp("J_UTL","util");
 		jsldp("J_MDE","mde");
diff --git a/copyparty/web/msg.html b/copyparty/web/msg.html
index 30f53d55..88488ed4 100644
--- a/copyparty/web/msg.html
+++ b/copyparty/web/msg.html
@@ -40,19 +40,19 @@ a{color:#fc5}</style>
 		{%- endif %}
 
 		{%- if click %}
-		<script>document.getElementsByTagName("a")[0].click()</script>
+		<script nonce="{{ js_nonce }}">document.getElementsByTagName("a")[0].click()</script>
 		{%- endif %}
 	</div>
 
 	{%- if redir %}
-	<script>
+	<script nonce="{{ js_nonce }}">
 		setTimeout(function() {
 			location.replace("{{ redir }}");
 		}, 800);
 	</script>
 	{%- endif %}
 	{%- if js %}
-	<script src="{{ js }}_={{ ts }}"></script>
+	<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 	{%- endif %}
 </body>
 
diff --git a/copyparty/web/rups.html b/copyparty/web/rups.html
index f2ad0de7..50b2cbce 100644
--- a/copyparty/web/rups.html
+++ b/copyparty/web/rups.html
@@ -22,9 +22,10 @@
         <div id="tw"></div>
     </div>
 	<a href="#" id="repl">π</a>
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR="{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
 	lang="{{ lang }}",
     dutc={{ this.args.js_utc }},
 	dfavico="{{ favico }}";
@@ -33,13 +34,13 @@ var STG = window.localStorage;
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
 
 </script>
-<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
-<script>var V={{ v }};</script>
-<script src="{{ r }}/.cpr/w/rups.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}">var V={{ v }};</script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/rups.js?_={{ ts }}"></script>
 {%- if js %}
-<script src="{{ js }}_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 {%- endif %}
-<script>
+<script nonce="{{ js_nonce }}">
 	Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 	jsldp("J_UTL","util");
 	jsldp("J_RUP","rups");
diff --git a/copyparty/web/shares.html b/copyparty/web/shares.html
index 51b89265..eb9d9c0b 100644
--- a/copyparty/web/shares.html
+++ b/copyparty/web/shares.html
@@ -62,9 +62,10 @@
         {%- endif %}
     </div>
 	<a href="#" id="repl">π</a>
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR="{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
     shr="{{ shr }}",
 	lang="{{ lang }}",
     dutc={{ this.args.js_utc }},
@@ -74,12 +75,12 @@ var STG = window.localStorage;
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
 
 </script>
-<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
-<script src="{{ r }}/.cpr/w/shares.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/shares.js?_={{ ts }}"></script>
 {%- if js %}
-<script src="{{ js }}_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 {%- endif %}
-<script>
+<script nonce="{{ js_nonce }}">
     Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
     jsldp("J_UTL","util");
     jsldp("J_SHR","shares");
diff --git a/copyparty/web/splash.html b/copyparty/web/splash.html
index 47f4d664..d359d40d 100644
--- a/copyparty/web/splash.html
+++ b/copyparty/web/splash.html
@@ -172,7 +172,7 @@
 			<a id="ag" href="{{ r }}/?idp">view idp cache</a><br />
 			{%- endif %}
 
-			<a id="k" href="{{ r }}/?reset" class="r" onclick="localStorage.clear();return true">reset client settings</a><br />
+			<a id="k" href="{{ r }}/?reset" class="r">reset client settings</a><br />
 
 			{%- if this.uname != '*' and not in_shr %}
 			<form method="post" enctype="multipart/form-data">
@@ -206,25 +206,31 @@
 	{%- if not this.args.nb %}
 	<span id="pb"><span>powered by</span> <a href="{{ this.args.pb_url }}">copyparty {{ver}}</a></span>
 	{%- endif %}
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR="{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
 	lang="{{ lang }}",
 	dfavico="{{ favico }}";
 
 var STG = window.localStorage;
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ this.args.theme }}";
 
+document.getElementById('k').onclick = function () {
+	localStorage.clear();
+	return true;
+};
+
 </script>
-<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
 {%- if lang != "eng" %}
-<script src="{{ r }}/.cpr/w/tl/{{ lang }}.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/tl/{{ lang }}.js?_={{ ts }}"></script>
 {%- endif %}
-<script src="{{ r }}/.cpr/w/splash.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/splash.js?_={{ ts }}"></script>
 {%- if js %}
-<script src="{{ js }}_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 {%- endif %}
-<script>
+<script nonce="{{ js_nonce }}">
 	Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 	jsldp("J_UTL","util");
 	jsldp("J_SPL","splash");
diff --git a/copyparty/web/svcs.html b/copyparty/web/svcs.html
index 5daa5d22..22d75127 100644
--- a/copyparty/web/svcs.html
+++ b/copyparty/web/svcs.html
@@ -347,9 +347,10 @@
 
     </div>
 	<a href="#" id="repl">π</a>
-	<script>
+	<script nonce="{{ js_nonce }}">
 
 var SR="{{ r }}",
+	JS_NONCE = "{{ js_nonce }}",
     lang="{{ lang }}",
 	dfavico="{{ favico }}";
 
@@ -357,12 +358,12 @@ var STG = window.localStorage;
 document.documentElement.className = (STG && STG.cpp_thm) || "{{ args.theme }}";
 
 </script>
-<script src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
-<script src="{{ r }}/.cpr/w/svcs.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/util.js?_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ r }}/.cpr/w/svcs.js?_={{ ts }}"></script>
 {%- if js %}
-<script src="{{ js }}_={{ ts }}"></script>
+<script nonce="{{ js_nonce }}" src="{{ js }}_={{ ts }}"></script>
 {%- endif %}
-<script>
+<script nonce="{{ js_nonce }}">
 	Date.now();function jsldp(a,b){2!=window[a]&&alert("FATAL ERROR: cannot load "+b+".js due to unreliable network or broken reverse-proxy; try CTRL-SHIFT-R")}
 	jsldp("J_UTL","util");
 	jsldp("J_SVC","svcs");
diff --git a/copyparty/web/tl/chi.js b/copyparty/web/tl/chi.js
index ac7184f5..1bfe4f2e 100644
--- a/copyparty/web/tl/chi.js
+++ b/copyparty/web/tl/chi.js
@@ -573,7 +573,7 @@ Ls.chi = {
 	"u_https1": "你应该",
 	"u_https2": "切换到 https",
 	"u_https3": "以获得更好的性能",
-	"u_ancient": '你还在用远古浏览器，也许你应该 <a href="#" onclick="goto(\'bup\')">改用 bup</a>',
+	"u_ancient": '你还在用远古浏览器，也许你应该 <a href="#" id="u2nah">改用 bup</a>',
 	"u_nowork": "需要 Firefox 53+ 或 Chrome 57+ 或 iOS 11+",
 	"tail_2old": "需要 Firefox 105+ 或 Chrome 71+ 或 iOS 14.5+",
 	"u_nodrop": '浏览器版本低，不支持通过拖动文件到窗口来上传文件',
diff --git a/copyparty/web/tl/cze.js b/copyparty/web/tl/cze.js
index bab572b5..a9e20716 100644
--- a/copyparty/web/tl/cze.js
+++ b/copyparty/web/tl/cze.js
@@ -576,7 +576,7 @@ Ls.cze = {
 	"u_https1": "měli byste",
 	"u_https2": "přejít na https",
 	"u_https3": "pro lepší výkon",
-	"u_ancient": "váš prohlížeč je úctyhodně starý -- možná byste měli <a href=\"#\" onclick=\"goto('bup')\">použít bup</a>",
+	"u_ancient": "váš prohlížeč je úctyhodně starý -- možná byste měli <a href=\"#\" id=\"u2nah\">použít bup</a>",
 	"u_nowork": "vyžadován firefox 53+ nebo chrome 57+ nebo iOS 11+",
 	"tail_2old": "vyžadován firefox 105+ nebo chrome 71+ nebo iOS 14.5+",
 	"u_nodrop": "váš prohlížeč je příliš starý pro nahrávání přetažením (drag-and-drop)",
diff --git a/copyparty/web/tl/deu.js b/copyparty/web/tl/deu.js
index cc7cffc7..4e3453c6 100644
--- a/copyparty/web/tl/deu.js
+++ b/copyparty/web/tl/deu.js
@@ -572,7 +572,7 @@ Ls.deu = {
 	"u_https1": "für bessere Performance solltest du",
 	"u_https2": "auf HTTPS wechseln",
 	"u_https3": " ",
-	"u_ancient": 'Dein Browser ist verdammt antik -- vielleicht solltest du <a href="#" onclick="goto(\'bup\')">stattdessen bup benutzen</a>',
+	"u_ancient": 'Dein Browser ist verdammt antik -- vielleicht solltest du <a href="#" id="u2nah">stattdessen bup benutzen</a>',
 	"u_nowork": "Benötigt Firefox 53+ oder Chrome 57+ oder iOS 11+",
 	"tail_2old": "Benötigt Firefox 105+ oder Chrome 71+ oder iOS 14.5+",
 	"u_nodrop": 'Dein Browser ist zu alt für Drag-and-Drop Uploads',
diff --git a/copyparty/web/tl/epo.js b/copyparty/web/tl/epo.js
index 8280b4be..7c9a5868 100644
--- a/copyparty/web/tl/epo.js
+++ b/copyparty/web/tl/epo.js
@@ -572,7 +572,7 @@ Ls.epo = {
 	"u_https1": "vi devas",
 	"u_https2": "ŝalti HTTPS-protokolon",
 	"u_https3": "por pli bona rendimento",
-	"u_ancient": 'via retumilo estas vere antikva -- eble vi devus <a href="#" onclick="goto(\'bup\')">uzi alŝutilon bup anstataŭe</a>',
+	"u_ancient": 'via retumilo estas vere antikva -- eble vi devus <a href="#" id="u2nah">uzi alŝutilon bup anstataŭe</a>',
 	"u_nowork": "Firefox 53+ aŭ Chrome 57+ aŭ iOS 11+ necesas",
 	"tail_2old": "Firefox 105+ aŭ Chrome 71+ aŭ iOS 14.5+ necesas",
 	"u_nodrop": 'via retumilo estas tro malnova por ŝova-kaj-demeta alŝutado',
diff --git a/copyparty/web/tl/fin.js b/copyparty/web/tl/fin.js
index 05d41252..820d3da9 100644
--- a/copyparty/web/tl/fin.js
+++ b/copyparty/web/tl/fin.js
@@ -572,7 +572,7 @@ Ls.fin = {
 	"u_https1": "sinun kannattaisi",
 	"u_https2": "vaihtaa https:ään",
 	"u_https3": "paremman suorituskyvyn vuoksi",
-	"u_ancient": 'selaimesi on ns. vaikuttavan ikivanha --  kannattais varmaan <a href="#" onclick="goto(\'bup\')">käyttää bup:ia tän sijaan</a>',
+	"u_ancient": 'selaimesi on ns. vaikuttavan ikivanha --  kannattais varmaan <a href="#" id="u2nah">käyttää bup:ia tän sijaan</a>',
 	"u_nowork": "tarvitaan firefox 53+ tai chrome 57+ tai iOS 11+",
 	"tail_2old": "tarvitaan firefox 105+ tai chrome 71+ tai iOS 14.5+",
 	"u_nodrop": 'selaimesi on liian vanha vedä-ja-pudota lataamiseen',
diff --git a/copyparty/web/tl/fra.js b/copyparty/web/tl/fra.js
index 2c56ed69..165cf778 100644
--- a/copyparty/web/tl/fra.js
+++ b/copyparty/web/tl/fra.js
@@ -572,7 +572,7 @@ Ls.fra = {
 	"u_https1": "vous devriez",
 	"u_https2": "passer à https",
 	"u_https3": "pour de meilleure performances",
-	"u_ancient": 'votre navigateur est impressionnamment ancien -- vous devriez peut-être <a href="#" onclick="goto(\'bup\')">utiliser bup à la place</a>',
+	"u_ancient": 'votre navigateur est impressionnamment ancien -- vous devriez peut-être <a href="#" id="u2nah">utiliser bup à la place</a>',
 	"u_nowork": "nécessite firefox 53+ ou chrome 57+ ou iOS 11+",
 	"tail_2old": "nécessite firefox 105+ ou chrome 71+ ou iOS 14.5+",
 	"u_nodrop": 'votre navigateur est trop ancien pour le téléversement par glisser-déposer',
diff --git a/copyparty/web/tl/grc.js b/copyparty/web/tl/grc.js
index 3b62c97a..5e746d26 100644
--- a/copyparty/web/tl/grc.js
+++ b/copyparty/web/tl/grc.js
@@ -572,7 +572,7 @@ Ls.grc = {
 	"u_https1": "πρέπει",
 	"u_https2": "μετάβαση σε https",
 	"u_https3": "για καλύτερη απόδοση",
-	"u_ancient": 'ο browser σου είναι εντυπωσιακά απαρχαιωμένος — ίσως να <a href="#" onclick="goto(\'bup\')">χρησιμοποιήσεις το bup αντί γι\' αυτό</a>',
+	"u_ancient": 'ο browser σου είναι εντυπωσιακά απαρχαιωμένος — ίσως να <a href="#" id="u2nah">χρησιμοποιήσεις το bup αντί γι\' αυτό</a>',
 	"u_nowork": "χρειάζεται firefox 53+ ή chrome 57+ ή iOS 11+",
 	"tail_2old": "χρειάζεται firefox 105+ ή chrome 71+ ή iOS 14.5+",
 	"u_nodrop": "ο browser σου είναι πολύ παλιός για drag&amp;drop μεταφορτώσεις",
diff --git a/copyparty/web/tl/hun.js b/copyparty/web/tl/hun.js
index 6e3005d1..295dfb9b 100644
--- a/copyparty/web/tl/hun.js
+++ b/copyparty/web/tl/hun.js
@@ -573,7 +573,7 @@ Ls.hun = {
 	"u_https1": 'érdemesebb lenne',
 	"u_https2": 'https-re váltani',
 	"u_https3": 'a jobb sebességért',
-	"u_ancient": 'lenyűgözően őskori a böngésződ -- talán <a href="#" onclick="goto(\'bup\')">használd inkább az egyszerű uploader-t</a>',
+	"u_ancient": 'lenyűgözően őskori a böngésződ -- talán <a href="#" id="u2nah">használd inkább az egyszerű uploader-t</a>',
 	"u_nowork": 'legalább Firefox 53, Chrome 57 vagy iOS 11 kell',
 	"tail_2old": 'legalább Firefox 105, Chrome 71 vagy iOS 14.5 kell',
 	"u_nodrop": 'a böngésződ túl öreg a drag-and-drop-hoz',
diff --git a/copyparty/web/tl/ita.js b/copyparty/web/tl/ita.js
index f65af456..9977286d 100644
--- a/copyparty/web/tl/ita.js
+++ b/copyparty/web/tl/ita.js
@@ -572,7 +572,7 @@ Ls.ita = {
 	"u_https1": "dovresti",
 	"u_https2": "passare a https",
 	"u_https3": "per prestazioni migliori",
-	"u_ancient": 'il tuo browser è incredibilmente antico -- forse dovresti <a href="#" onclick="goto(\'bup\')">usare bup invece</a>',
+	"u_ancient": 'il tuo browser è incredibilmente antico -- forse dovresti <a href="#" id="u2nah">usare bup invece</a>',
 	"u_nowork": "serve firefox 53+ o chrome 57+ o iOS 11+",
 	"tail_2old": "serve firefox 105+ o chrome 71+ o iOS 14.5+",
 	"u_nodrop": 'il tuo browser è troppo vecchio per il caricamento drag-and-drop',
diff --git a/copyparty/web/tl/jpn.js b/copyparty/web/tl/jpn.js
index cf59813c..e710f3ba 100644
--- a/copyparty/web/tl/jpn.js
+++ b/copyparty/web/tl/jpn.js
@@ -572,7 +572,7 @@ Ls.jpn = {
 	"u_https1": "あなたはするべき",
 	"u_https2": "httpsに切り替える",
 	"u_https3": "パフォーマンス向上のため",
-	"u_ancient": '現在のブラウザは驚くほど古いです -- <a href="#" onclick="goto(\'bup\')">代わりにbup</a>を使った方がいいかもしれません',
+	"u_ancient": '現在のブラウザは驚くほど古いです -- <a href="#" id="u2nah">代わりにbup</a>を使った方がいいかもしれません',
 	"u_nowork": "Firefox 53以降、Chrome 57以降、またはiOS 11以降が必要です",
 	"tail_2old": "Firefox 105以降、Chrome 71以降、またはiOS 14.5以降が必要です",
 	"u_nodrop": '現在のブラウザは古すぎてドラッグ＆ドロップによるアップロードに対応していません',
diff --git a/copyparty/web/tl/kor.js b/copyparty/web/tl/kor.js
index e2f4b122..1f0ce3a5 100644
--- a/copyparty/web/tl/kor.js
+++ b/copyparty/web/tl/kor.js
@@ -572,7 +572,7 @@ Ls.kor = {
 	"u_https1": "더 나은 성능을 위해",
 	"u_https2": "https로 전환",
 	"u_https3": "하는 것이 좋습니다",
-	"u_ancient": '브라우저가 정말 오래되었네요 -- 아마도 <a href="#" onclick="goto(\'bup\')">bup을 대신 사용</a>해야 할 것 같습니다',
+	"u_ancient": '브라우저가 정말 오래되었네요 -- 아마도 <a href="#" id="u2nah">bup을 대신 사용</a>해야 할 것 같습니다',
 	"u_nowork": "Firefox 53+, Chrome 57+ 또는 iOS 11+가 필요합니다",
 	"tail_2old": "Firefox 105+, Chrome 71+ 또는 iOS 14.5+가 필요합니다",
 	"u_nodrop": '브라우저가 너무 오래되어 드래그 앤 드롭 업로드를 지원하지 않습니다',
diff --git a/copyparty/web/tl/nld.js b/copyparty/web/tl/nld.js
index 373b62a7..4bf3ab30 100644
--- a/copyparty/web/tl/nld.js
+++ b/copyparty/web/tl/nld.js
@@ -572,7 +572,7 @@ Ls.nld = {
 	"u_https1": "Je moet",
 	"u_https2": "overschakelen naar https",
 	"u_https3": "voor betere prestaties",
-	"u_ancient": 'Je browser is indrukwekkend oud -- misschien moet je <a href="#" onclick="goto(\'bup\')">in plaats daarvan bup gebruiken</a>',
+	"u_ancient": 'Je browser is indrukwekkend oud -- misschien moet je <a href="#" id="u2nah">in plaats daarvan bup gebruiken</a>',
 	"u_nowork": "Je moet firefox 53+ of chrome 57+ of iOS 11+ hebben",
 	"tail_2old": "Je moet firefox 105+ of chrome 71+ of iOS 14.5+ hebben",
 	"u_nodrop": 'Je browser is te oud voor uploaden via slepen en neerzetten',
diff --git a/copyparty/web/tl/nno.js b/copyparty/web/tl/nno.js
index d6342f68..7ff794a0 100644
--- a/copyparty/web/tl/nno.js
+++ b/copyparty/web/tl/nno.js
@@ -569,7 +569,7 @@ Ls.nno = {
 	"u_https1": "du burde",
 	"u_https2": "bytte åt https",
 	"u_https3": "for høgare hastigheit",
-	"u_ancient": 'nettlesaren din er prehistorisk -- mulig du burde <a href="#" onclick="goto(\'bup\')">bruke bup i staden for</a>',
+	"u_ancient": 'nettlesaren din er prehistorisk -- mulig du burde <a href="#" id="u2nah">bruke bup i staden for</a>',
 	"u_nowork": "krev firefox 53+, chrome 57+, eller iOS 11+",
 	"tail_2old": "krev firefox 105+, chrome 71+, eller iOS 14.5+",
 	"u_nodrop": 'nettlesaren din er for gamal åt å laste opp filer ved å drage dei inn i vindauget',
diff --git a/copyparty/web/tl/nor.js b/copyparty/web/tl/nor.js
index 76b2c35c..f638ce96 100644
--- a/copyparty/web/tl/nor.js
+++ b/copyparty/web/tl/nor.js
@@ -569,7 +569,7 @@ Ls.nor = {
 	"u_https1": "du burde",
 	"u_https2": "bytte til https",
 	"u_https3": "for høyere hastighet",
-	"u_ancient": 'nettleseren din er prehistorisk -- mulig du burde <a href="#" onclick="goto(\'bup\')">bruke bup istedenfor</a>',
+	"u_ancient": 'nettleseren din er prehistorisk -- mulig du burde <a href="#" id="u2nah">bruke bup istedenfor</a>',
 	"u_nowork": "krever firefox 53+, chrome 57+, eller iOS 11+",
 	"tail_2old": "krever firefox 105+, chrome 71+, eller iOS 14.5+",
 	"u_nodrop": 'nettleseren din er for gammel til å laste opp filer ved å dra dem inn i vinduet',
diff --git a/copyparty/web/tl/pol.js b/copyparty/web/tl/pol.js
index 88fa3f23..abe28305 100644
--- a/copyparty/web/tl/pol.js
+++ b/copyparty/web/tl/pol.js
@@ -575,7 +575,7 @@ Ls.pol = {
 	"u_https1": "powinieneś przejść",
 	"u_https2": "na HTTPS w celu",
 	"u_https3": "uzyskania lepszej wydajności",
-	"u_ancient": 'twoja przeglądarka jest niezwykle zabytkowa -- powinieneś zamiast tego <a href="#" onclick="goto(\'bup\')">użyć bup</a>',
+	"u_ancient": 'twoja przeglądarka jest niezwykle zabytkowa -- powinieneś zamiast tego <a href="#" id="u2nah">użyć bup</a>',
 	"u_nowork": "wymaga Firefox 53+, Chrome 57+ lub iOS 11+",
 	"tail_2old": "wymaga Firefox 105+, Chrome 71+ lub iOS 14.5+",
 	"u_nodrop": 'ta przeglądarka jest za stara, nie wspiera przesyłania "przeciągnij i upuść"',
diff --git a/copyparty/web/tl/por.js b/copyparty/web/tl/por.js
index b13a557f..9117be83 100644
--- a/copyparty/web/tl/por.js
+++ b/copyparty/web/tl/por.js
@@ -572,7 +572,7 @@ Ls.por = {
 	"u_https1": "você deveria",
 	"u_https2": "mudar para https",
 	"u_https3": "para um melhor desempenho",
-	"u_ancient": 'seu navegador é impressionantemente antigo -- talvez você devesse <a href="#" onclick="goto(\'bup\')">usar o bup em vez disso</a>',
+	"u_ancient": 'seu navegador é impressionantemente antigo -- talvez você devesse <a href="#" id="u2nah">usar o bup em vez disso</a>',
 	"u_nowork": "precisa do firefox 53+ ou chrome 57+ ou iOS 11+",
 	"tail_2old": "precisa do firefox 105+ ou chrome 71+ ou iOS 14.5+",
 	"u_nodrop": 'seu navegador é muito antigo para upload de arrastar e soltar',
diff --git a/copyparty/web/tl/rus.js b/copyparty/web/tl/rus.js
index 4a3ebec8..bb717806 100644
--- a/copyparty/web/tl/rus.js
+++ b/copyparty/web/tl/rus.js
@@ -572,7 +572,7 @@ Ls.rus = {
 	"u_https1": "вам стоит",
 	"u_https2": "включить https",
 	"u_https3": "для лучшей производительности",
-	"u_ancient": 'у вас действительно антикварный браузер -- возможно, стоит <a href="#" onclick="goto(\'bup\')">использовать bup</a>',
+	"u_ancient": 'у вас действительно антикварный браузер -- возможно, стоит <a href="#" id="u2nah">использовать bup</a>',
 	"u_nowork": "требуется firefox 53+, chrome 57+ или iOS 11+",
 	"tail_2old": "требуется firefox 105+, chrome 71+ или iOS 14.5+",
 	"u_nodrop": 'ваш браузер слишком старый для загрузки через перетаскивание',
diff --git a/copyparty/web/tl/spa.js b/copyparty/web/tl/spa.js
index 41ac34ad..410fbc0d 100644
--- a/copyparty/web/tl/spa.js
+++ b/copyparty/web/tl/spa.js
@@ -571,7 +571,7 @@ Ls.spa = {
 	"u_https1": "deberías",
 	"u_https2": "cambiar a https",
 	"u_https3": "para un mejor rendimiento",
-	"u_ancient": "tu navegador es impresionantemente antiguo -- quizás deberías <a href=\"#\" onclick=\"goto('bup')\">usar bup en su lugar</a>",
+	"u_ancient": "tu navegador es impresionantemente antiguo -- quizás deberías <a href=\"#\" id=\"u2nah\">usar bup en su lugar</a>",
 	"u_nowork": "se necesita firefox 53+ o chrome 57+ o iOS 11+",
 	"tail_2old": "se necesita firefox 105+ o chrome 71+ o iOS 14.5+",
 	"u_nodrop": "tu navegador es demasiado antiguo para subir arrastrando y soltando",
diff --git a/copyparty/web/tl/swe.js b/copyparty/web/tl/swe.js
index ed4f5327..e59c5da2 100644
--- a/copyparty/web/tl/swe.js
+++ b/copyparty/web/tl/swe.js
@@ -572,7 +572,7 @@ Ls.swe = {
 	"u_https1": "du bör",
 	"u_https2": "byta till https",
 	"u_https3": "för bättre prestanda",
-	"u_ancient": 'din webbläsare är imponerande uråldrig -- du kanske borde <a href="#" onclick="goto(\'bup\')">använda bup istället</a>',
+	"u_ancient": 'din webbläsare är imponerande uråldrig -- du kanske borde <a href="#" id="u2nah">använda bup istället</a>',
 	"u_nowork": "firefox 53+ eller chrome 57+ eller iOS 11+ krävs",
 	"tail_2old": "firefox 105+ eller chrome 71+ eller iOS 14.5+ krävs",
 	"u_nodrop": 'din webbläsare är för gammal för dra-och-släpp-uppladdning',
diff --git a/copyparty/web/tl/tur.js b/copyparty/web/tl/tur.js
index 1cbfde9f..19a9e911 100644
--- a/copyparty/web/tl/tur.js
+++ b/copyparty/web/tl/tur.js
@@ -572,7 +572,7 @@ Ls.tur = {
 	"u_https1": "daha iyi performans",
 	"u_https2": "için https'i",
 	"u_https3": "kullanın",
-	"u_ancient": 'tarayıcınız resmen fosilleşmiş -- belki de <a href="#" onclick="goto(\'bup\')">bup kullanmalısınız</a>',
+	"u_ancient": 'tarayıcınız resmen fosilleşmiş -- belki de <a href="#" id="u2nah">bup kullanmalısınız</a>',
 	"u_nowork": "firefox 53+ veya chrome 57+ veya iOS 11+ gerekiyor",
 	"tail_2old": "firefox 105+ veya chrome 71+ veya iOS 14.5+ gerekiyor",
 	"u_nodrop": 'tarayıcınız sürükleyip bırakmak için çok eski',
diff --git a/copyparty/web/tl/ukr.js b/copyparty/web/tl/ukr.js
index 9c7b54d8..bcc50992 100644
--- a/copyparty/web/tl/ukr.js
+++ b/copyparty/web/tl/ukr.js
@@ -572,7 +572,7 @@ Ls.ukr = {
 	"u_https1": "вам слід",
 	"u_https2": "переключитися на https",
 	"u_https3": "для кращої продуктивності",
-	"u_ancient": 'ваш браузер вражаюче старий -- можливо, вам слід <a href="#" onclick="goto(\'bup\')">використовувати bup замість цього</a>',
+	"u_ancient": 'ваш браузер вражаюче старий -- можливо, вам слід <a href="#" id="u2nah">використовувати bup замість цього</a>',
 	"u_nowork": "потрібен firefox 53+ або chrome 57+ або iOS 11+",
 	"tail_2old": "потрібен firefox 105+ або chrome 71+ або iOS 14.5+",
 	"u_nodrop": 'ваш браузер занадто старий для перетягування завантажень',
diff --git a/copyparty/web/tl/vie.js b/copyparty/web/tl/vie.js
index e47cd04e..772ca67c 100644
--- a/copyparty/web/tl/vie.js
+++ b/copyparty/web/tl/vie.js
@@ -581,7 +581,7 @@ Ls.vie = {
 	"u_https2": "chuyển sang https",
 	"u_https3": "để có hiệu suất tốt hơn",
 
-	"u_ancient": "trình duyệt của bạn quá cũ; bạn có thể <a href=\"#\" onclick=\"goto('bup')\">dùng bup</a> thay thế",
+	"u_ancient": "trình duyệt của bạn quá cũ; bạn có thể <a href=\"#\" id=\"u2nah\">dùng bup</a> thay thế",
 	"u_nowork": "cần Firefox 53+, Chrome 57+ hoặc iOS 11+",
 	"tail_2old": "cần Firefox 105+, Chrome 71+ hoặc iOS 14.5+",
 	"u_nodrop": "trình duyệt của bạn quá cũ để dùng kéo thả khi tải lên",
diff --git a/copyparty/web/up2k.js b/copyparty/web/up2k.js
index 4750765b..1d8bb5f2 100644
--- a/copyparty/web/up2k.js
+++ b/copyparty/web/up2k.js
@@ -780,8 +780,20 @@ function sfx_nice() {
 }
 
 
-function fsearch_explain(n) {
-    if (n)
+function bind_fsearch_explain() {
+    var o = QSA('.fsearch_explain');
+    for (var a = 0, aa = o.length; a < aa; a++)
+        o[a].onclick = fsearch_explain;
+}
+
+
+function fsearch_explain() {
+    var a = this.getAttribute('a');
+
+    if (a == "u")
+        return toast.inf(60, L.ue_ab);
+
+    if (a == "r")
         return toast.inf(60, L.ue_ro + (acct == '*' ? L.ue_nl : L.ue_la).format(acct));
 
     if (bcfg_get('fsearch', false))
@@ -801,7 +813,7 @@ function up2k_init(subtle) {
 
     setTimeout(function () {
         if (WebAssembly && !hws.length)
-            fetch(SR + '/.cpr/w/w.hash.js?_=' + TS);
+            fetch(SR + '/.cpr/w/deps/sha512.hw.js?_=' + TS);
     }, 1000);
 
     function showmodal(msg) {
@@ -842,6 +854,7 @@ function up2k_init(subtle) {
             var o = mknod('div', 'u2depmsg');
             o.innerHTML = nosubtle ? '' : m;
             ebi('u2foot').appendChild(o);
+            setmonclick();
         }
         loading_deps = true;
     }
@@ -858,12 +871,13 @@ function up2k_init(subtle) {
             ebi('u2err').className = '';
             ebi('u2err').innerHTML = '';
         }
-        if (msg == suggest_up2k) {
-            ebi('u2yea').onclick = function (e) {
-                ev(e);
-                goto('up2k');
-            };
-        }
+        setmonclick();
+    }
+
+    function setmonclick() {
+        var x;
+        x = ebi('u2yea'); if (x) x.onclick = go2up2k;
+        x = ebi('u2nah'); if (x) x.onclick = go2bup;
     }
 
     function un2k(msg) {
@@ -1470,11 +1484,11 @@ function up2k_init(subtle) {
             }
 
             for (var a = 0; a < nw; a++)
-                hws.push(new Worker(SR + '/.cpr/w/w.hash.js?_=' + TS));
+                hws.push(new Worker(SR + '/.cpr/w/deps/sha512.hw.js?_=' + TS));
 
             if (!subtle)
                 for (var a = 0; a < hws.length; a++)
-                    hws[a].postMessage('nosubtle');
+                    hws[a].postMessage(['nosubtle']);
 
             console.log(hws.length + " hashers");
         }
@@ -1557,7 +1571,11 @@ function up2k_init(subtle) {
             if (!actx || actx.state != 'suspended' || toast.visible)
                 return;
 
-            toast.warn(30, "<div onclick=\"start_actx();toast.inf(3,'thanks!')\">" + L.u_actx + "</div>");
+            toast.warn(30, '<div id="actx_go">' + L.u_actx + '</div>');
+            ebi('actx_go').onclick = function () {
+                start_actx();
+                toast.inf(3, 'thanks!');
+            };
         }, 500);
     }
 
@@ -2294,7 +2312,7 @@ function up2k_init(subtle) {
             var w = hws[a];
             w.onmessage = onmsg;
             if (init)
-                w.postMessage('ping');
+                w.postMessage(['ping']);
             if (mem > 0)
                 free.push(w);
             mem -= chunksize;
@@ -2548,8 +2566,9 @@ function up2k_init(subtle) {
 
                     if (!response || !response.hits || !response.hits.length) {
                         smsg = '404';
-                        msg = (L.u_s404 + ' <a href="#" onclick="fsearch_explain(' +
-                            (has(perms, 'write') ? '0' : '1') + ')" class="fsearch_explain">(' + L.u_expl + ')</a>');
+                        msg = (L.u_s404 + ' <a href="#" class="fsearch_explain" a="' +
+                            (has(perms, 'write') ? 'w' : 'r') + '">(' + L.u_expl + ')</a>');
+                        timer.add(bind_fsearch_explain);
                     }
                     else {
                         smsg = 'found';
@@ -2747,7 +2766,8 @@ function up2k_init(subtle) {
                         }
                     }
                     if (err_pend) {
-                        err += ' <a href="#" onclick="toast.inf(60, L.ue_ab);" class="fsearch_explain">(' + L.u_expl + ')</a>';
+                        err += ' <a href="#" class="fsearch_explain" a="u">(' + L.u_expl + ')</a>';
+                        timer.add(bind_fsearch_explain);
                     }
                 }
 
diff --git a/copyparty/web/util.js b/copyparty/web/util.js
index fbda90e4..92e1155a 100644
--- a/copyparty/web/util.js
+++ b/copyparty/web/util.js
@@ -201,7 +201,7 @@ function vis_exh(msg, url, lineNo, columnNo, error) {
     window.onerror = undefined;
     var html = [
         '<h1>you hit a bug!</h1>',
-        '<p style="font-size:1.3em;margin:0;line-height:2em">try to <a href="#" onclick="localStorage.clear();location.reload();">reset copyparty settings</a> if you are stuck here, or <a href="#" onclick="ignex();">ignore this</a> / <a href="#" onclick="ignex(true);">ignore all</a> / <a href="?b=u">basic</a></p>',
+        '<p style="font-size:1.3em;margin:0;line-height:2em">try to <a href="#" id="exh_wipecfg">reset copyparty settings</a> if you are stuck here, or <a href="#" id="exh_ignex">ignore this</a> / <a href="#" id="exh_ignexa">ignore all</a> / <a href="?b=u">basic</a></p>',
         '<p style="color:#fff">please send me a screenshot arigathanks gozaimuch: <a href="<ghi>" target="_blank">new github issue</a></p>',
         '<p class="b">' + esc(url + ' @' + lineNo + ':' + columnNo), '<br />' + esc(msg).replace(/\n/g, '<br />') + '</p>',
         '<p><b>UA:</b> ' + esc(UA)
@@ -286,14 +286,23 @@ function vis_exh(msg, url, lineNo, columnNo, error) {
     catch (e) {
         document.body.innerHTML = html.join('\n');
     }
+    var x = ebi('exh_wipecfg');
+    if (x) x.onclick = function () {
+        localStorage.clear();
+        location.reload();
+    };
+    x = ebi('exh_ignex'); if (x) x.onclick = ignex;
+    x = ebi('exh_ignexa'); if (x) x.onclick = ignexa;
 }
-function ignex(all) {
+function ignexa() {
     var o = ebi('exbox');
     o.style.display = 'none';
     o.innerHTML = '';
     crashed = false;
-    if (!all)
-        window.onerror = vis_exh;
+}
+function ignex() {
+    ignexa();
+    window.onerror = vis_exh;
 }
 window.onerror = vis_exh;
 
@@ -434,6 +443,8 @@ function import_js(url, cb, ecb) {
     var head = document.head || document.getElementsByTagName('head')[0];
     var script = mknod('script');
     script.type = 'text/javascript';
+    if (window.JS_NONCE)
+        script.nonce = JS_NONCE;
     script.src = url + '?_=' + (window.TS || 'a');
     script.onload = cb;
     script.onerror = ecb || function () {
diff --git a/copyparty/web/w.hash.js b/copyparty/web/w.hash.js
index ae54c37d..24f5be14 100644
--- a/copyparty/web/w.hash.js
+++ b/copyparty/web/w.hash.js
@@ -1,5 +1,5 @@
-"use strict";
-
+// here begins copyparty/web/w.hash.js
+if (typeof document == 'undefined') {
 
 function hex2u8(txt) {
     return new Uint8Array(txt.match(/.{2}/g).map(function (b) { return parseInt(b, 16); }));
@@ -29,9 +29,6 @@ catch (ex) {
 }
 function load_fb() {
     subtle = null;
-    if (self.hashwasm)
-        return;
-    importScripts('deps/sha512.hw.js');
     console.log('using fallback hasher');
 }
 
@@ -42,10 +39,12 @@ var reader = null,
 
 
 onmessage = (d) => {
-    if (d.data == 'nosubtle')
+    var d0 = d.data[0];
+
+    if (d0 == 'nosubtle')
         return load_fb();
 
-    if (d.data == 'ping')
+    if (d0 == 'ping')
         return postMessage(['pong']);
 
     if (busy)
@@ -123,3 +122,5 @@ onmessage = (d) => {
         }
     };
 }
+
+}
\ No newline at end of file
diff --git a/scripts/deps-docker/Dockerfile b/scripts/deps-docker/Dockerfile
index 485461dd..3f9cc6b5 100644
--- a/scripts/deps-docker/Dockerfile
+++ b/scripts/deps-docker/Dockerfile
@@ -81,7 +81,9 @@ RUN     tar --no-same-owner -xf zopfli.tgz \
 
 # build hash-wasm
 RUN     cd hash-wasm/dist \
-        && mv sha512.umd.min.js /z/dist/sha512.hw.js
+        && echo '"use strict";' > /z/dist/sha512.hw.js \
+        && cat sha512.umd.min.js >> /z/dist/sha512.hw.js \
+        && touch -r sha512.umd.min.js /z/dist/sha512.hw.js
 
 
 # build marked
diff --git a/scripts/make-sfx.sh b/scripts/make-sfx.sh
index f6f86e09..7aa04cc8 100755
--- a/scripts/make-sfx.sh
+++ b/scripts/make-sfx.sh
@@ -124,6 +124,7 @@ pybin=$(command -v python3 || command -v python) || {
 	echo
 	exit 1
 }
+self="$(pwd)"
 
 langs=
 use_gz=
@@ -442,7 +443,8 @@ rm -f \
 	copyparty/web/Makefile*
 
 find copyparty | LC_ALL=C sort | sed -r 's/\.gz$//;s/$/,/' > have
-cat have | while IFS= read -r x; do
+grep <have -vE '^copyparty/web/w.hash.js,$' |
+while IFS= read -r x; do
 	grep -qF -- "$x" ../scripts/sfx.ls || {
 		echo "unexpected file: $x"
 		exit 1
@@ -570,6 +572,9 @@ while IFS= read -r f; do
 	ised 's/(^class [^(:]+):/\1(object):/' "$f"
 done
 
+[ -e copyparty/web/w.hash.js ] &&
+	ised 's` // .*``;s` //console.*``;s`^ +$``' copyparty/web/w.hash.js
+
 # up2k goes from 28k to 22k laff
 awk 'BEGIN{gensub(//,"",1)}' </dev/null 2>/dev/null &&
 echo entabbening &&
@@ -594,6 +599,19 @@ find | grep -E '\.(js|html)$' | while IFS= read -r f; do
 	tmv "$f"
 done
 
+# csp nonce blocks importScripts; make webworker bundle (single-member gz only)
+[ $repack ] || (
+	cd copyparty/web
+	[ -e w.hash.js.gz ] || [ -e w.hash.js ] && {
+		echo modding sha512.hw.js
+		[ -e deps/sha512.hw.js.gz ] && gzip -d deps/sha512.hw.js.gz
+		[ -e w.hash.js.gz ] && gzip -d w.hash.js
+		iawk '/copyparty/{exit}/./' deps/sha512.hw.js
+		printf '\n\n\n\n\n' >> deps/sha512.hw.js
+		cat w.hash.js >> deps/sha512.hw.js
+	}
+)
+
 gzres() {
 	local pk=
 	[ "$zopf" = no ] && return
@@ -619,7 +637,7 @@ gzres() {
 	done < <(
 		find -printf '%s %p\n' |
 		grep -E '\.(js|css)$|/web/a/.*\.txt$' |
-		grep -vF /deps/ |
+		awk '/sha512.hw.js/||!/\/deps\//' |
 		sort -nr
 	)
 	wait
@@ -630,6 +648,9 @@ gzres
 [ $udep ] &&
     find -iname '*.gz' | while IFS= read -r x; do gzip -d "$x"; done
 
+[ $repack ] ||
+	cp -p copyparty/web/deps/sha512.hw.js* "$self/copyparty/web/deps/"
+
 echo gen tarlist
 for d in copyparty partftpy magic j2 py2 py37 ftp; do find $d -type f || true; done |  # strip_hints
 sed -r 's/(.*)\.(.*)/\2 \1/' | LC_ALL=C sort |
diff --git a/scripts/sfx.ls b/scripts/sfx.ls
index 7578b96b..48637e05 100644
--- a/scripts/sfx.ls
+++ b/scripts/sfx.ls
@@ -141,4 +141,3 @@ copyparty/web/tl/vie.js,
 copyparty/web/ui.css,
 copyparty/web/up2k.js,
 copyparty/web/util.js,
-copyparty/web/w.hash.js,
diff --git a/scripts/tl.js b/scripts/tl.js
index cfee97b8..b52422c3 100644
--- a/scripts/tl.js
+++ b/scripts/tl.js
@@ -602,7 +602,7 @@ Ls.hmn = {
 	"u_https1": "you should",
 	"u_https2": "switch to https",
 	"u_https3": "for better performance",
-	"u_ancient": 'your browser is impressively ancient -- maybe you should <a href="#" onclick="goto(\'bup\')">use bup instead</a>',
+	"u_ancient": 'your browser is impressively ancient -- maybe you should <a href="#" id="u2nah">use bup instead</a>',
 	"u_nowork": "need firefox 53+ or chrome 57+ or iOS 11+",
 	"tail_2old": "need firefox 105+ or chrome 71+ or iOS 14.5+",
 	"u_nodrop": 'your browser is too old for drag-and-drop uploading',
diff --git a/tests/util.py b/tests/util.py
index 6cdb7ed5..f9955f24 100644
--- a/tests/util.py
+++ b/tests/util.py
@@ -160,13 +160,13 @@ class Cfg(Namespace):
         ex = "hash_mt hsortn qdel safe_dedup scan_pr_r scan_pr_s scan_st_r srch_time tail_fd tail_rate th_spec_p u2abort u2j u2sz unp_who"
         ka.update(**{k: 1 for k in ex.split()})
 
-        ex = "ac_convt au_vol dl_list du_iwho mtab_age reg_cap s_thead s_tbody tail_tmax tail_who th_convt th_qv th_qvx ups_who ver_iwho zip_who"
+        ex = "ac_convt au_vol dl_list du_iwho mcr mtab_age reg_cap s_thead s_tbody tail_tmax tail_who th_convt th_qv th_qvx ups_who ver_iwho zip_who"
         ka.update(**{k: 9 for k in ex.split()})
 
         ex = "ctl_re db_act forget_ip gauto idp_cookie idp_store k304 loris no304 nosubtle qr_pin qr_wait re_maxage rproxy rsp_jtr rsp_slp s_wr_slp snap_wri theme themes turbo u2ow zipmaxn zipmaxs"
         ka.update(**{k: 0 for k in ex.split()})
 
-        ex = "ah_alg bname chdir chmod_f chpw_db db_xattr doctitle df epilogues exit favico fika ipa ipar html_head html_head_d html_head_s idp_login idp_logout lg_sba lg_sbf log_date log_fk md_sba md_sbf name og_desc og_site og_th og_title og_title_a og_title_v og_title_i opds_exts preadmes prologues readmes shr shr1 shr_site site smsg tcolor textfiles th_pregen txt_eol ufavico ufavico_h unlist up_site vc_url vname xff_src zipmaxt R RS SR"
+        ex = "ah_alg bname chdir chmod_f chpw_db csp_dl csp_ui db_xattr doctitle df epilogues exit favico fika ipa ipar html_head html_head_d html_head_s idp_login idp_logout lg_sba lg_sbf log_date log_fk md_sba md_sbf name og_desc og_site og_th og_title og_title_a og_title_v og_title_i opds_exts preadmes prologues readmes shr shr1 shr_site site smsg tcolor textfiles th_pregen txt_eol ufavico ufavico_h unlist up_site vc_url vname xff_src zipmaxt R RS SR"
         ka.update(**{k: "" for k in ex.split()})
 
         ex = "apnd_who ban_403 ban_404 ban_422 ban_pw ban_pwc ban_url dont_ban cachectl http_vary rcm rss_fmt_d rss_fmt_t spinner"