Fix various issues in forms.

app/Http/Middleware/SecureHeaders.php

@@ -51,17 +51,17 @@ class SecureHeaders
         $response          = $next($request);
         $trackingScriptSrc = $this->getTrackingScriptSource();
         $csp               = [
-//            "default-src 'none'",
-//            "object-src 'none'",
-//            "require-trusted-types-for 'script'",
-//            sprintf("script-src 'unsafe-inline' 'strict-dynamic' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
-//            "style-src 'unsafe-inline' 'self'",
-//            "frame-ancestors 'none'",
-//            "base-uri 'self'",
-//            "font-src 'self' data:",
-//            "connect-src 'self'",
-//            sprintf("img-src 'self' data: https://a.tile.openstreetmap.org https://b.tile.openstreetmap.org https://c.tile.openstreetmap.org https://api.tiles.mapbox.com %s", $trackingScriptSrc),
-//            "manifest-src 'self'",
+            "default-src 'none'",
+            "object-src 'none'",
+            "require-trusted-types-for 'script'",
+            //sprintf("script-src 'unsafe-inline' 'strict-dynamic' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
+            sprintf("script-src 'unsafe-eval' 'strict-dynamic' 'self' 'unsafe-inline' 'nonce-%1s' %2s", $nonce, $trackingScriptSrc),
+            "style-src 'unsafe-inline' 'self'",
+            "base-uri 'self'",
+            "font-src 'self' data:",
+            "connect-src 'self'",
+            sprintf("img-src data: 'strict-dynamic' 'self' *.tile.openstreetmap.org %s", $trackingScriptSrc),
+            "manifest-src 'self'",
         ];
 
         $route = $request->route();
@@ -79,7 +79,7 @@ class SecureHeaders
             "camera 'none'",
             "magnetometer 'none'",
             "gyroscope 'none'",
-            "speaker 'none'",
+            //"speaker 'none'",
             //"vibrate 'none'",
             "fullscreen 'self'",
             "payment 'none'",

frontend/src/components/transactions/TransactionAccount.vue

@@ -22,8 +22,8 @@
   <div class="form-group">
     <div v-if="visible" class="text-xs d-none d-lg-block d-xl-block">
       <span v-if="0 === this.index">{{ $t('firefly.' + this.direction + '_account') }}</span>
-      <span v-if="this.index > 0" class="text-warning">{{ $t('firefly.first_split_overrules_' + this.direction) }}</span><br>
-      <span>{{ selectedAccount }}</span>
+      <span v-if="this.index > 0" class="text-warning">{{ $t('firefly.first_split_overrules_' + this.direction) }}</span>
+      <!--<br><span>{{ selectedAccount }}</span> -->
     </div>
     <div v-if="!visible" class="text-xs d-none d-lg-block d-xl-block">
       &nbsp;

frontend/src/components/transactions/TransactionAmount.vue

@@ -33,6 +33,7 @@
           autocomplete="off"
           name="amount[]"
           type="number"
+          step="any"
       >
     </div>
     <span v-if="errors.length > 0">

resources/views/v2/accounts/create.twig

@@ -6,7 +6,7 @@
 <div id="accounts_create"></div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // this is a terrible hack.
         var previousURL = '{{ Session.get('accounts.create.uri') }}';
     </script>

resources/views/v2/accounts/delete.twig

@@ -6,7 +6,7 @@
 <div id="accounts_delete"></div>
 {% endblock %}
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // this is a terrible hack.
         var previousURL = '{{ Session.get('accounts.delete.uri') }}';
     </script>

resources/views/v2/transactions/create.twig

@@ -15,7 +15,7 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // this is a terrible hack.
         var previousURL = '{{ previousUri }}';
     </script>

resources/views/v2/transactions/edit.twig

@@ -15,7 +15,7 @@
 {% endblock %}
 
 {% block scripts %}
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
         // this is a terrible hack.
         var previousURL = '{{ previousUri }}';
     </script>