diff --git a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineRating.jsp b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineRating.jsp
index 7d8cefa5..2768b8f6 100644
--- a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineRating.jsp
+++ b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineRating.jsp
@@ -75,7 +75,7 @@
 <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
 <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
 <link rel="stylesheet" href="https://code.jquery.com/ui/1.10.3/themes/smoothness/jquery-ui.css">
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     $(function() {
         initRatingSlider($("#slider"), $("#sliderover"), $("#ratingvalue"));
     });
diff --git a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolDetails.jsp b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolDetails.jsp
index 5883c2ba..936aa7f3 100644
--- a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolDetails.jsp
+++ b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolDetails.jsp
@@ -594,7 +594,7 @@ a { text-decoration: none; }
 <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
 <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     $(function() {
         initRatingSlider($("#ratingSlider"), $("#ratingSliderOver"), $("#reviewValue"));
         initRatingSlider($("#ratingSliderPop"), $("#ratingSliderOverPop"), $("#reviewValuePop"));
diff --git a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolManageOwners.jsp b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolManageOwners.jsp
index 4532a6ad..12ae9298 100644
--- a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolManageOwners.jsp
+++ b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolManageOwners.jsp
@@ -47,7 +47,7 @@
 <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
 <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     var ownersTxt = $("#toolOwners");
     ownersTxt.focus();
     ownersTxt.val("<%= h(toolOwners) %>");
diff --git a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreUpload.jsp b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreUpload.jsp
index 6e32cc0b..a53641ca 100644
--- a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreUpload.jsp
+++ b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreUpload.jsp
@@ -52,7 +52,7 @@
 <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
 <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     autocomplete($("#toolOwners"), <%=users%>);
     initJqueryUiImages("<%= h(imgDir + "jquery-ui") %>");
 </script>
diff --git a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreWebPart.jsp b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreWebPart.jsp
index 4e5a83ad..aa523a67 100644
--- a/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreWebPart.jsp
+++ b/SkylineToolsStore/src/org/labkey/skylinetoolsstore/view/SkylineToolsStoreWebPart.jsp
@@ -384,7 +384,7 @@
 <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js"></script>
 <link rel="stylesheet" href="https://code.jquery.com/ui/1.10.3/themes/smoothness/jquery-ui.css">
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     var READ_MORE_TEXT = "Read more";
     var READ_LESS_TEXT = "Close";
     var BASE_SLIDE_TIME = 100;
diff --git a/lincs/resources/views/CustomGCT.html b/lincs/resources/views/CustomGCT.html
index 7d7bdfc3..eaf878bc 100644
--- a/lincs/resources/views/CustomGCT.html
+++ b/lincs/resources/views/CustomGCT.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
     LABKEY.requiresCss("/lincs/lincs.css");
 
diff --git a/lincs/src/org/labkey/lincs/view/customGCTForm.jsp b/lincs/src/org/labkey/lincs/view/customGCTForm.jsp
index f6c35e6e..9eff6cb0 100644
--- a/lincs/src/org/labkey/lincs/view/customGCTForm.jsp
+++ b/lincs/src/org/labkey/lincs/view/customGCTForm.jsp
@@ -43,7 +43,7 @@
     span.heading {margin-bottom:20px 10px 20px 10px;}
 </style>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     // Download Ext4 js and css files.
     // LABKEY.requiresExt4Sandbox();
diff --git a/lincs/src/org/labkey/lincs/view/downloadCustomGCT.jsp b/lincs/src/org/labkey/lincs/view/downloadCustomGCT.jsp
index 946e438c..2cf98ce9 100644
--- a/lincs/src/org/labkey/lincs/view/downloadCustomGCT.jsp
+++ b/lincs/src/org/labkey/lincs/view/downloadCustomGCT.jsp
@@ -48,7 +48,7 @@
     downloadGctUrl.addParameter("fileName", fileName);
 %>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     LABKEY.requiresCss("/lincs/lincs.css");
     LABKEY.requiresScript("/lincs/lincs.js");
diff --git a/panoramapublic/resources/views/peptideSearchResults.html b/panoramapublic/resources/views/peptideSearchResults.html
index e8141ba9..99e1d0c2 100644
--- a/panoramapublic/resources/views/peptideSearchResults.html
+++ b/panoramapublic/resources/views/peptideSearchResults.html
@@ -1,5 +1,5 @@
 <div id="search-indicator"></div>
-<script type="text/javascript" nonce="<%=getScriptNonce()%>">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
         let webpart = <%=webpartContext%>;
         const queryString = window.location.search;
diff --git a/panoramapublic/resources/views/proteinSearchResults.html b/panoramapublic/resources/views/proteinSearchResults.html
index 75713d6c..1402d483 100644
--- a/panoramapublic/resources/views/proteinSearchResults.html
+++ b/panoramapublic/resources/views/proteinSearchResults.html
@@ -1,5 +1,5 @@
 <div id="search-indicator"></div>
-<script type="text/javascript" nonce="<%=getScriptNonce()%>">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
         let webpart = <%=webpartContext%>;
         const queryString = window.location.search;
diff --git a/panoramapublic/resources/views/smallMoleculeSearchResults.html b/panoramapublic/resources/views/smallMoleculeSearchResults.html
index 71cd3024..4ffaf43c 100644
--- a/panoramapublic/resources/views/smallMoleculeSearchResults.html
+++ b/panoramapublic/resources/views/smallMoleculeSearchResults.html
@@ -1,5 +1,5 @@
 <div id="search-indicator"></div>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=scriptNonce%>">
 
         let webpart = <%=webpartContext%>;
         const queryString = window.location.search;
diff --git a/panoramapublic/src/org/labkey/panoramapublic/query/ExperimentAnnotationsTableInfo.java b/panoramapublic/src/org/labkey/panoramapublic/query/ExperimentAnnotationsTableInfo.java
index 45f3c317..07dbec2d 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/query/ExperimentAnnotationsTableInfo.java
+++ b/panoramapublic/src/org/labkey/panoramapublic/query/ExperimentAnnotationsTableInfo.java
@@ -622,9 +622,9 @@ public HtmlString getFormattedHtml(RenderContext ctx)
 
     private static class AutoCompleteColumn extends DataColumn
     {
-        private String _autoCompletionUrl;
-        private boolean _prefetch;
-        private String _placeholderText;
+        private final String _autoCompletionUrl;
+        private final boolean _prefetch;
+        private final String _placeholderText;
 
         public AutoCompleteColumn(ColumnInfo col, ActionURL autocompletionUrl, boolean prefetch, String placeHolderText)
         {
@@ -647,14 +647,14 @@ public void renderInputHtml(RenderContext ctx, Writer out, Object value) throws
             String renderId = getRenderId();
             StringBuilder sb = new StringBuilder();
 
-            sb.append("<script type=\"text/javascript\">");
+            sb.append("<script type=\"text/javascript\" nonce=\"").append(HttpView.currentPageConfig().getScriptNonce()).append("\">");
             sb.append("LABKEY.requiresScript([\"/PanoramaPublic/js/ExpAnnotAutoComplete.js\"], function() {\n");
             sb.append("Ext4.onReady(function(){\n");
             sb.append("    initAutoComplete(").append(_autoCompletionUrl).append(", '").append(renderId).append("', ").append(_prefetch ? "true": "false").append(");\n");
             sb.append("});});\n");
             sb.append("</script>\n");
             sb.append("<div style=\"margin-top:5px;\" id=\"").append(renderId).append("\" class=\"scrollable-dropdown-menu\">");
-            sb.append("<input type=\"text\" class=\"tags\" placeholder=\"" + _placeholderText + "\" name=\"" + name + "\" value=\"" + valueString + "\">");
+            sb.append("<input type=\"text\" class=\"tags\" placeholder=\"").append(_placeholderText).append("\" name=\"").append(name).append("\" value=\"").append(valueString).append("\">");
             sb.append("</div>");
             sb.append("<div style=\"font-size:11px\">").append(PageFlowUtil.filter(getHelpText(), true, false)).append("</div>");
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/combinationModInfo.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/combinationModInfo.jsp
index 6db2fbca..edc5c967 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/combinationModInfo.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/combinationModInfo.jsp
@@ -38,7 +38,7 @@
 
 <div id="combinationModInfoForm"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     const elementOrder = {}; // Order of elements in a normalized formula
     let idx = 0;
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/editSpecLibInfo.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/editSpecLibInfo.jsp
index 4dc4911d..c677ca6d 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/editSpecLibInfo.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/editSpecLibInfo.jsp
@@ -31,7 +31,7 @@
 <labkey:errors/>
 <div id="editSpecLibInfoForm"/>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/expannotations/experimentDetails.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/expannotations/experimentDetails.jsp
index 25b7315a..e2d626af 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/expannotations/experimentDetails.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/expannotations/experimentDetails.jsp
@@ -230,7 +230,7 @@
  }
 
 </style>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
@@ -369,7 +369,7 @@
 
 </div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     var SHOW_MORE_TEXT = "[Show more]";
     var SHOW_LESS_TEXT = "[Show less]";
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/CatalogEntryWebPart.java b/panoramapublic/src/org/labkey/panoramapublic/view/publish/CatalogEntryWebPart.java
index 837ff9d2..260d0a37 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/CatalogEntryWebPart.java
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/CatalogEntryWebPart.java
@@ -1,6 +1,5 @@
 package org.labkey.panoramapublic.view.publish;
 
-import org.labkey.api.action.UrlProvider;
 import org.labkey.api.data.Container;
 import org.labkey.api.portal.ProjectUrls;
 import org.labkey.api.security.User;
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/catalogEntryForm.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/catalogEntryForm.jsp
index ae8017a0..1ba31498 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/catalogEntryForm.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/catalogEntryForm.jsp
@@ -1,19 +1,19 @@
 <%
-    /*
-     * Copyright (c) 2008-2019 LabKey Corporation
-     *
-     * Licensed under the Apache License, Version 2.0 (the "License");
-     * you may not use this file except in compliance with the License.
-     * You may obtain a copy of the License at
-     *
-     *     http://www.apache.org/licenses/LICENSE-2.0
-     *
-     * Unless required by applicable law or agreed to in writing, software
-     * distributed under the License is distributed on an "AS IS" BASIS,
-     * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-     * See the License for the specific language governing permissions and
-     * limitations under the License.
-     */
+/*
+ * Copyright (c) 2008-2019 LabKey Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 %>
 <%@ taglib prefix="labkey" uri="http://www.labkey.org/taglib" %>
 <%@ page import="org.apache.commons.io.FileUtils" %>
@@ -161,7 +161,7 @@
 </div>
 
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     let cropper;
     let croppedImageDataUrl;
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/confirmPublish.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/confirmPublish.jsp
index d051ccd1..4646604c 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/confirmPublish.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/confirmPublish.jsp
@@ -25,7 +25,7 @@
 <div id="publishDataDetails"></div>
 <div id="publishDataForm"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/copyExperimentForm.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/copyExperimentForm.jsp
index 7c0866cf..02d6fbf9 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/copyExperimentForm.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/copyExperimentForm.jsp
@@ -86,7 +86,7 @@
     <%=link("ProteomeXchange Actions", pxActionsUrl)%>
 </div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publicationDetails.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publicationDetails.jsp
index 6cb28d03..3705c6d6 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publicationDetails.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publicationDetails.jsp
@@ -24,7 +24,7 @@
 
 <div id="publishDataForm"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishExperimentForm.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishExperimentForm.jsp
index b393fef5..23761ef1 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishExperimentForm.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishExperimentForm.jsp
@@ -107,7 +107,7 @@
         color: red;
     }
 </style>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     var urlFixedPre = <%=q(AppProps.getInstance().getBaseServerUrl() + AppProps.getInstance().getContextPath() + "/")%>;
     var urlFixedPost = <%=q(ShortURLRecord.URL_SUFFIX)%>;
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishSuccessView.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishSuccessView.jsp
index e7ec51c9..0486d6db 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishSuccessView.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/publishSuccessView.jsp
@@ -73,7 +73,7 @@
     </div>
 </div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     <% if (canAddCatalogEntry) { %>
         Ext4.onReady(function() {
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxActions.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxActions.jsp
index 70429825..9ed9b5a1 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxActions.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxActions.jsp
@@ -47,7 +47,7 @@
 <div id="pxLinks"></div>
 <div id="pxMethodsForm"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxMissingFiles.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxMissingFiles.jsp
index c86dfa41..e7f55c68 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxMissingFiles.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxMissingFiles.jsp
@@ -30,7 +30,7 @@
 
 <div id="missingFilesDiv"/>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function() {
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationRunning.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationRunning.jsp
index 45df6c7d..42757b59 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationRunning.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationRunning.jsp
@@ -44,7 +44,7 @@
 
 <div style="margin-top:10px;" id="validationProgressDiv"></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     var htmlEncode = Ext4.util.Format.htmlEncode;
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationStatus.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationStatus.jsp
index db2cf38c..9878746c 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationStatus.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/pxValidationStatus.jsp
@@ -44,7 +44,7 @@
 
 <div id="validationStatusDiv"/>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     // Links that helped:
     // https://docs.sencha.com/extjs/4.2.2/extjs-build/examples/build/KitchenSink/ext-theme-neptune/#row-expander-grid
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/publish/updatePxDetails.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/publish/updatePxDetails.jsp
index 07fe9d30..38b7b11d 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/publish/updatePxDetails.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/publish/updatePxDetails.jsp
@@ -30,7 +30,7 @@
     </ul>
 </div>
 <div style="margin-top:15px;" id="updateDetailsForm"></div>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/search/panoramaWebSearch.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/search/panoramaWebSearch.jsp
index a8af3e1c..09d07549 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/search/panoramaWebSearch.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/search/panoramaWebSearch.jsp
@@ -176,7 +176,7 @@
 
 </div>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     const expSearchPanelItemId = 'expSearchPanel';
     const authorsItemId = 'Authors';
     const titleItemId = 'Title';
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/unimodMatchInfo.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/unimodMatchInfo.jsp
index 42437a49..5bef62d7 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/unimodMatchInfo.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/unimodMatchInfo.jsp
@@ -46,7 +46,7 @@
 <% } %>
 <div style="width:800px;margin-top:30px; margin-left:8px;"><%=button("Cancel").href(form.getCancelActionURL(PanoramaPublicController.getViewExperimentDetailsURL(form.getId(), getContainer()))).style("padding:4px 15px")%></div>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce=<%=getScriptNonce()%>>
 
     Ext4.onReady(function(){
 
diff --git a/panoramapublic/src/org/labkey/panoramapublic/view/viewSlideshow.jsp b/panoramapublic/src/org/labkey/panoramapublic/view/viewSlideshow.jsp
index 012ee74a..80f238e1 100644
--- a/panoramapublic/src/org/labkey/panoramapublic/view/viewSlideshow.jsp
+++ b/panoramapublic/src/org/labkey/panoramapublic/view/viewSlideshow.jsp
@@ -35,7 +35,7 @@
 
 <labkey:errors/>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     Ext4.onReady(function() {
 
diff --git a/signup/src/org/labkey/signup/SignUpAdmin.jsp b/signup/src/org/labkey/signup/SignUpAdmin.jsp
index 6fffc302..98b10aec 100644
--- a/signup/src/org/labkey/signup/SignUpAdmin.jsp
+++ b/signup/src/org/labkey/signup/SignUpAdmin.jsp
@@ -139,7 +139,7 @@
 <%
 JSONObject json = new JSONObject(m);
 %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     function showAdd(group) {
         if (group.length > 1)
diff --git a/testresults/src/org/labkey/testresults/view/errorFiles.jsp b/testresults/src/org/labkey/testresults/view/errorFiles.jsp
index a07b10be..90efde32 100644
--- a/testresults/src/org/labkey/testresults/view/errorFiles.jsp
+++ b/testresults/src/org/labkey/testresults/view/errorFiles.jsp
@@ -21,7 +21,7 @@
 
 <%@include file="menu.jsp" %>
 <script src="https://code.jquery.com/jquery-2.1.3.min.js"></script>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
 </script>
 <p>All the files listed below at one point or another failed to post.  When a run is successfully posted through this page it gets removed from the list.</p>
@@ -48,7 +48,7 @@
     </table><br/>
 <% } %>
 <p><a href="filecontent-begin.view">Files</a></p>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     $(document).ajaxStart(function() {
         $("#loading").show();
     }).ajaxStop(function() {
diff --git a/testresults/src/org/labkey/testresults/view/failureDetail.jsp b/testresults/src/org/labkey/testresults/view/failureDetail.jsp
index 650f4a16..00d540c9 100644
--- a/testresults/src/org/labkey/testresults/view/failureDetail.jsp
+++ b/testresults/src/org/labkey/testresults/view/failureDetail.jsp
@@ -173,7 +173,7 @@
 %>
 
 <%@include file="menu.jsp" %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
     LABKEY.requiresCss("/TestResults/css/tablesorter-default.css");
 </script>
@@ -250,7 +250,7 @@
     </tbody>
 </table>
 
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 $(document).ready(function() {
     const problemData = <%=json(problemData, 0)%>;
 
diff --git a/testresults/src/org/labkey/testresults/view/flagged.jsp b/testresults/src/org/labkey/testresults/view/flagged.jsp
index 53942ef6..999356a1 100644
--- a/testresults/src/org/labkey/testresults/view/flagged.jsp
+++ b/testresults/src/org/labkey/testresults/view/flagged.jsp
@@ -17,7 +17,7 @@
 %>
 
 <%@include file="menu.jsp" %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
 </script>
 <p>Runs which are flagged will not show up in the Overview breakdown, Long Term, and Failure pages.  This includes graphs, charts, and any other sort of data visualization.</p>
diff --git a/testresults/src/org/labkey/testresults/view/longTerm.jsp b/testresults/src/org/labkey/testresults/view/longTerm.jsp
index f05765c6..1d7948e7 100644
--- a/testresults/src/org/labkey/testresults/view/longTerm.jsp
+++ b/testresults/src/org/labkey/testresults/view/longTerm.jsp
@@ -57,7 +57,7 @@
 
     <% if (trendsJson != null) { %>
         <script src="<%=h(contextPath)%>/TestResults/js/generateTrendCharts.js"></script>
-        <script type="text/javascript">
+        <script type="text/javascript" nonce="<%=getScriptNonce()%>">
             var trendsJson = jQuery.parseJSON(<%= q(trendsJson.toString())%>);
             var failureJson = jQuery.parseJSON(<%= q(failureJson.toString())%>);
             var runCountPerDayJson = jQuery.parseJSON(<%=q(runCountPerDayJson.toString())%>);
diff --git a/testresults/src/org/labkey/testresults/view/multiFailureDetail.jsp b/testresults/src/org/labkey/testresults/view/multiFailureDetail.jsp
index 75968acc..79d3dfc4 100644
--- a/testresults/src/org/labkey/testresults/view/multiFailureDetail.jsp
+++ b/testresults/src/org/labkey/testresults/view/multiFailureDetail.jsp
@@ -77,7 +77,7 @@
     <input type="submit" value="Submit">
 </form>
 <!-- Selects the View Type in the combobox -->
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     document.getElementById("<%=h(viewType)%>").selected = "true";
 </script>
 
@@ -133,7 +133,7 @@
 </table>
 
 <!-- Pie Chart -->
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     var piechart = c3.generate({
         bindto: '#piechart',
         data: {
@@ -170,7 +170,7 @@
     }
 %>
 <% if(!failureTrends.isEmpty()) {%>
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="<%=getScriptNonce()%>">
         var failureJSON = jQuery.parseJSON( <%= q(failureTrends.toString()) %> );
         var dates = failureJSON.dates;
         for (var i = 0; i < dates.length; i++) {
diff --git a/testresults/src/org/labkey/testresults/view/runDetail.jsp b/testresults/src/org/labkey/testresults/view/runDetail.jsp
index e3bcf341..486f94aa 100644
--- a/testresults/src/org/labkey/testresults/view/runDetail.jsp
+++ b/testresults/src/org/labkey/testresults/view/runDetail.jsp
@@ -25,7 +25,7 @@
 %>
 
 <%@include file="menu.jsp" %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
     var csrf_header = {"X-LABKEY-CSRF": LABKEY.CSRF};
     var popupData = function(data) {
@@ -90,7 +90,7 @@
     <button onclick="showLog();">View Log</button>
 
     <!--Script to handle deleting of run-->
-    <script>
+    <script type="text/javascript" nonce="<%=getScriptNonce()%>">
         <% if (run.isFlagged()) { %>
         var current = "<%=h(contextPath)%>/TestResults/img/flagon.png";
         var opposite = "<%=h(contextPath)%>/TestResults/img/flagoff.png";
@@ -200,7 +200,7 @@ if (leaks.length > 0) { %>
     <tr><td<% if (hang != null) { %> style="background: yellow;"<% } %>>Posted: <%=h(formatDateTime(run.getPostTime()))%></td></tr>
     </table>
 <!--Handles add/remove from training data set-->
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     $('#trainset').click(function() {
         var csrf_header = {"X-LABKEY-CSRF": LABKEY.CSRF};
         $(this).off().text("Please wait...");
@@ -214,7 +214,7 @@ if (leaks.length > 0) { %>
     });
 </script>
 <!--Script using c3 & d3js which generates memory graph-->
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     var jsonObject = jQuery.parseJSON( <%=q(data.getMemoryJson(run.getId(), false).toString())%>);
     var passes = [];
     var pass = 0;
diff --git a/testresults/src/org/labkey/testresults/view/rundown.jsp b/testresults/src/org/labkey/testresults/view/rundown.jsp
index b7be51ad..24baed2a 100644
--- a/testresults/src/org/labkey/testresults/view/rundown.jsp
+++ b/testresults/src/org/labkey/testresults/view/rundown.jsp
@@ -58,7 +58,7 @@
     Container c = getViewContext().getContainer();
     DateFormat dfMDHM = new SimpleDateFormat("MM/dd HH:mm:ss");
 %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
 </script>
 <link rel="stylesheet" href="//code.jquery.com/ui/1.11.2/themes/smoothness/jquery-ui.css">
@@ -286,7 +286,7 @@
             </div>
         </div>
     </div>
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="<%=getScriptNonce()%>">
         $('#stats').text("<%=errorRuns%> Errors | <%=warningRuns%> Warnings | <%=goodRuns%> Passes | <%=missingUsers.length%> Missing");
     </script>
     <% } %>
@@ -302,7 +302,7 @@
                     <option value="<%=h(ViewType.YEAR)%>" id="<%=h(ViewType.YEAR)%>">Year</option>
                 </select>
             </center>
-            <script type="text/javascript">
+            <script type="text/javascript" nonce="<%=getScriptNonce()%>">
                 $('#viewType').on('change', function() {
                     let url = <%=jsURL(new ActionURL(TestResultsController.BeginAction.class, c).addParameter("end", df.format(selectedDate)))%>;
                     url.searchParams.set('viewType', this.value);
@@ -338,7 +338,7 @@
                     <td><%=topFailures.get(key).size()%></td>
                     <td>
                         <div id="<%=h(key)%>" class="c3chart" style="width: 120px; height: 120px;"></div>
-                        <script>
+                        <script type="text/javascript" nonce="<%=getScriptNonce()%>">
                             var <%=h(key)%> = c3.generate({
                                 bindto: '#<%=h(key)%>',
                                 data: {
@@ -415,7 +415,7 @@
     </div>
 
 <% if (memoryChartData != null) { %>
-    <script>
+    <script type="text/javascript" nonce="<%=getScriptNonce()%>">
         var pointRatio = 30;
         var jsonObject = <%=json(memoryChartData, 0)%>;
         // start c3 chart generation
@@ -511,7 +511,7 @@
 </div>
 </div>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 $(function() {
     const csrf_header = {"X-LABKEY-CSRF": LABKEY.CSRF};
 
@@ -589,19 +589,19 @@ $(function() {
     $(".matrix-leak-handle").tooltip();
 });
 </script>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     document.getElementById("<%=h(viewType)%>").selected = "true";
 </script>
 
 <% if (trendsJson != null) { %>
     <script src="<%=h(contextPath)%>/TestResults/js/generateTrendCharts.js"></script>
-    <script type="text/javascript">
+    <script type="text/javascript" nonce="<%=getScriptNonce()%>">
         var trendsJson = <%=json(trendsJson, 0)%>;
         generateTrendCharts(trendsJson);
     </script>
 <% } %>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 /* Initialize sortable table */
 $(function() {
     $(".rundown-user-passes").tooltip();
diff --git a/testresults/src/org/labkey/testresults/view/trainingdata.jsp b/testresults/src/org/labkey/testresults/view/trainingdata.jsp
index a12caa8f..626dac40 100644
--- a/testresults/src/org/labkey/testresults/view/trainingdata.jsp
+++ b/testresults/src/org/labkey/testresults/view/trainingdata.jsp
@@ -25,7 +25,7 @@
     Container c = getViewContext().getContainer();
     List<User> noRunsForUser = new ArrayList<>();
 %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
 </script>
 <link rel="stylesheet" href="//code.jquery.com/ui/1.11.2/themes/smoothness/jquery-ui.css">
@@ -191,7 +191,7 @@
         <% } %>
     </table>
 </div>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
 
     var csrf_header = {"X-LABKEY-CSRF": LABKEY.CSRF};
 
diff --git a/testresults/src/org/labkey/testresults/view/user.jsp b/testresults/src/org/labkey/testresults/view/user.jsp
index 4bab5473..dad3748b 100644
--- a/testresults/src/org/labkey/testresults/view/user.jsp
+++ b/testresults/src/org/labkey/testresults/view/user.jsp
@@ -64,7 +64,7 @@
         }
     }
 %>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     LABKEY.requiresCss("/TestResults/css/style.css");
 </script>
 <link rel="stylesheet" href="//code.jquery.com/ui/1.11.2/themes/smoothness/jquery-ui.css">
@@ -196,7 +196,7 @@
 <% } %>
     </div>
 
-<script>
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     function paramRedirect(startDate, endDate) {
         if (!startDate) {
             var dateRange = $('#jrange input').val();
@@ -266,7 +266,7 @@
 <!--Javascript which uses c3 & d3js to paint charts with given trendJson data-->
 <% if (trendsJson != null) { %>
 <script src="<%= h(contextPath) %>/TestResults/js/generateTrendCharts.js"></script>
-<script type="text/javascript">
+<script type="text/javascript" nonce="<%=getScriptNonce()%>">
     function generateCharts() {
         var trendsJson = jQuery.parseJSON( <%= q(trendsJson.toString()) %> );
         var memData = null;