Rom1-B · Nov 10, 2026 · Nov 10, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Changed
+
+- Make the plugin compatible with the Content Security Policy (requires the GLPI release with CSP support)
+
 ## [2.12.12] - 2026-10-06
 
 ### Fixed

diff --git a/inc/bill.class.php b/inc/bill.class.php
@@ -360,8 +360,7 @@ public static function showOrder($data_ref, $result_ref, $canedit, $order, $refe
             $itemtype = $data_ref["itemtype"];
             $item     = getItemForItemtype($itemtype);
             echo "<tr><th><ul class='list-unstyled'><li>";
-            echo sprintf("<a href=\"javascript:showHideDiv('generation%d','generation_img%d', '", $rand, $rand)
-              . $CFG_GLPI['root_doc'] . "/pics/plus.png','" . $CFG_GLPI['root_doc'] . "/pics/moins.png');\">";
+            echo sprintf("<a href='#' data-order-show-div='generation%d' data-order-show-img='generation_img%d'>", $rand, $rand);
             echo sprintf("<img alt='' name='generation_img%d' src=\"", $rand) . $CFG_GLPI['root_doc'] . '/pics/plus.png">';
             echo "</a>";
             echo "</li></ul></th>";
@@ -479,12 +478,12 @@ public static function showOrder($data_ref, $result_ref, $canedit, $order, $refe
             echo "<div class='center'>";
             echo "<table width='950px' class='tab_glpi'>";
             echo "<tr><td<i class='fas fa-level-up-alt fa-flip-horizontal fa-lg mx-2'></i></td><td class='center'>";
-            echo sprintf("<a onclick= \"if ( markCheckboxes('bills_form%d') ) ", $rand)
-              . "return false;\" href='#'>" . __s("Check all") . "</a></td>";
+            echo sprintf("<a data-order-mark-checkboxes='bills_form%d' href='#'>", $rand)
+              . __s("Check all") . "</a></td>";
 
             echo "<td>/</td><td class='center'>";
-            echo sprintf("<a onclick= \"if ( unMarkCheckboxes('bills_form%d') ) ", $rand)
-              . "return false;\" href='#'>" . __s("Uncheck all") . "</a>";
+            echo sprintf("<a data-order-unmark-checkboxes='bills_form%d' href='#'>", $rand)
+              . __s("Uncheck all") . "</a>";
             echo "</td><td align='left' width='80%'>";
             echo Html::hidden('plugin_order_orders_id', ['value' => $order->getID()]);
             $order_item->dropdownBillItemsActions($order->getID());

diff --git a/inc/order.class.php b/inc/order.class.php
@@ -1696,9 +1696,9 @@ public function showValidationForm($orders_id)
                 $link = "";
 
                 if ($this->canCancelOrder()) {
-                    echo "<input type='submit' onclick=\"return confirm('"
+                    echo "<input type='submit' data-glpi-confirm=\""
                     . __s("Do you really want to cancel this order ? This option is irreversible !", "order")
-                    . "')\" name='cancel_order' value=\"" . __s("Cancel order", "order") . "\" class='submit'>";
+                    . "\" name='cancel_order' value=\"" . __s("Cancel order", "order") . "\" class='submit'>";
                     $link = "<br><br>";
                 }
 
@@ -1709,9 +1709,9 @@ public function showValidationForm($orders_id)
                 }
 
                 if ($this->canCancelValidationRequest()) {
-                    echo $link . "<input type='submit' onclick=\"return confirm('"
+                    echo $link . "<input type='submit' data-glpi-confirm=\""
                     . __s("Do you want to cancel the validation approval ?", "order")
-                    . "')\" name='cancel_waiting_for_approval' value=\""
+                    . "\" name='cancel_waiting_for_approval' value=\""
                     . __s("Cancel ask for validation", "order") . "\" class='submit'>";
                     $link = "<br><br>";
                 }
@@ -1723,9 +1723,9 @@ public function showValidationForm($orders_id)
                 }
 
                 if ($this->canUndoValidation()) {
-                    echo $link . "<input type='submit' onclick=\"return confirm('"
+                    echo $link . "<input type='submit' data-glpi-confirm=\""
                     . __s("Do you really want to edit the order ?", "order")
-                    . "')\" name='undovalidation' value=\""
+                    . "\" name='undovalidation' value=\""
                     . __s("Edit order", "order") . "\" class='submit'>";
                     $link = "<br><br>";
                 }

diff --git a/inc/order_item.class.php b/inc/order_item.class.php
@@ -650,7 +650,8 @@ public function showAddForm($plugin_order_orders_id)
                                 }
 
                         };");
-                    echo "<input type='checkbox' id='addreference' onclick='plugin_order_checkboxAction()' name='addreference' value='0' />";
+                    echo "<input type='checkbox' id='addreference' name='addreference' value='0' />";
+                    echo Html::scriptBlock('$("#addreference").on("click", function () { plugin_order_checkboxAction(); });');
                     echo "</span></td>";
 
                     echo "<td class='tab_bg_1' name='add_reference' style='display: none;'><span id='show_addreference'>";
@@ -1742,8 +1743,7 @@ public function showBillsItemsDetail($data_ref, $result_ref, $canedit, $order, $
             $itemtype = $data_ref["itemtype"];
             $item     = getItemForItemtype($itemtype);
             echo "<tr><th><ul class='list-unstyled'><li>";
-            echo sprintf("<a href=\"javascript:showHideDiv('generation%d','generation_img%d', '", $rand, $rand)
-              . $CFG_GLPI['root_doc'] . "/pics/plus.png','" . $CFG_GLPI['root_doc'] . "/pics/moins.png');\">";
+            echo sprintf("<a href='#' data-order-show-div='generation%d' data-order-show-img='generation_img%d'>", $rand, $rand);
             echo sprintf("<img alt='' name='generation_img%d' src=\"", $rand) . $CFG_GLPI['root_doc'] . '/pics/plus.png">';
             echo "</a>";
             echo "</li></ul></th>";
@@ -1863,12 +1863,12 @@ public function showBillsItemsDetail($data_ref, $result_ref, $canedit, $order, $
             echo "<div class='center'>";
             echo "<table width='950px' class='tab_cadre_fixe left'>";
             echo "<tr><td><i class='fas fa-level-up-alt fa-flip-horizontal fa-lg mx-2'></i></td><td class='center'>";
-            echo sprintf("<a onclick= \"if ( markCheckboxes('bills_form%d') ) ", $rand)
-              . "return false;\" href='#'>" . __s("Check all") . "</a></td>";
+            echo sprintf("<a data-order-mark-checkboxes='bills_form%d' href='#'>", $rand)
+              . __s("Check all") . "</a></td>";
 
             echo "<td>/</td><td class='center'>";
-            echo sprintf("<a onclick= \"if ( unMarkCheckboxes('bills_form%d') ) ", $rand)
-              . "return false;\" href='#'>" . __s("Uncheck all") . "</a>";
+            echo sprintf("<a data-order-unmark-checkboxes='bills_form%d' href='#'>", $rand)
+              . __s("Uncheck all") . "</a>";
             echo "</td><td align='left' width='80%'>";
             echo Html::hidden('plugin_order_orders_id', ['value' => $order->getID()]);
             $this->dropdownBillItemsActions($order->getID());

diff --git a/inc/order_supplier.class.php b/inc/order_supplier.class.php
@@ -276,10 +276,10 @@ public static function showOrderSupplierInfos($ID)
                 echo "<tr>";
                 echo sprintf("<td><i class='%s fa-flip-horizontal fa-lg mx-2'></i></td>", $arrow);
                 echo "<td class='center' style='white-space:nowrap;'>";
-                echo sprintf("<a onclick= \"if ( markCheckboxes('%s') ) return false;\" href='#'>", $formname) . __s('Check all') . "</a></td>";
+                echo sprintf("<a data-order-mark-checkboxes='%s' href='#'>", htmlescape($formname)) . __s('Check all') . "</a></td>";
                 echo "<td>/</td>";
                 echo "<td class='center' style='white-space:nowrap;'>";
-                echo sprintf("<a onclick= \"if ( unMarkCheckboxes('%s') ) return false;\" href='#'>", $formname) . __s('Uncheck all') . "</a></td>";
+                echo sprintf("<a data-order-unmark-checkboxes='%s' href='#'>", htmlescape($formname)) . __s('Uncheck all') . "</a></td>";
                 echo "<td class='left' width='80%'>";
 
                 echo "<input type='submit' name='delete' ";

diff --git a/inc/reception.class.php b/inc/reception.class.php
@@ -394,8 +394,7 @@ public function showOrderReceptionItem($data_ref, $numref, $canedit, $reference,
             $item = getItemForItemtype($typeRef);
             $rand = mt_rand();
             echo "<tr><th><ul class='list-unstyled'><li>";
-            echo sprintf("<a href=\"javascript:showHideDiv('reception%d','reception_img%d', '", $rand, $rand)
-              . $CFG_GLPI['root_doc'] . "/pics/plus.png','" . $CFG_GLPI['root_doc'] . "/pics/moins.png');\">";
+            echo sprintf("<a href='#' data-order-show-div='reception%d' data-order-show-img='reception_img%d'>", $rand, $rand);
             echo sprintf("<img alt='' name='reception_img%d' src=\"", $rand) . $CFG_GLPI['root_doc'] . '/pics/plus.png">';
             echo "</a>";
             echo "</li></ul></th>";
@@ -507,7 +506,7 @@ public function showOrderReceptionItem($data_ref, $numref, $canedit, $reference,
                         'rand' => $rand,
                     ],
                 );
-                echo "&nbsp;<button type='button' class='btn btn-secondary btn-sm' onclick='selectNItems(\"mass" . self::class . sprintf("%d\", \"dropdown_nb_items_to_check_top_%d\")'>", $rand, $rand) . __s("Select") . "</button>";
+                echo sprintf("&nbsp;<button type='button' class='btn btn-secondary btn-sm' data-order-select-container='%s' data-order-select-target='%s'>", htmlescape('mass' . self::class . $rand), htmlescape('dropdown_nb_items_to_check_top_' . $rand)) . __s("Select") . "</button>";
                 echo "</span>";
             }
 
@@ -625,7 +624,7 @@ public function showOrderReceptionItem($data_ref, $numref, $canedit, $reference,
                             'rand' => $rand,
                         ],
                     );
-                    echo "&nbsp;<button type='button' class='btn btn-secondary btn-sm' onclick='selectNItems(\"mass" . self::class . sprintf("%d\", \"dropdown_nb_items_to_check_bottom_%d\")'>", $rand, $rand) . __s("Select") . "</button>";
+                    echo sprintf("&nbsp;<button type='button' class='btn btn-secondary btn-sm' data-order-select-container='%s' data-order-select-target='%s'>", htmlescape('mass' . self::class . $rand), htmlescape('dropdown_nb_items_to_check_bottom_' . $rand)) . __s("Select") . "</button>";
                     echo "</span>";
                 }
 
@@ -685,8 +684,10 @@ private function displayBulkReceptionForm($order_order, $orders_id, $references_
 
         if ($order_order->canDeliver() && $this->checkItemStatus($orders_id, $references_id, PluginOrderOrder::ORDER_DEVICE_NOT_DELIVRED) && $typeRef != 'SoftwareLicense') {
             $bulk_rand = mt_rand();
-            $button = "<p><a href='javascript:viewmassreception" . $suffix . $orders_id . ($bulk_rand . "();'>");
+            $button_id = 'massreception_button' . $suffix . $orders_id . $bulk_rand;
+            $button = sprintf("<p><a href='#' id='%s'>", $button_id);
             $button .= __s("Take item delivery (bulk)", "order") . "</a></p>";
+            $button .= Html::scriptBlock(sprintf("\$('#%s').on('click', function (e) { e.preventDefault(); viewmassreception%s%d%d(); });", $button_id, $suffix, $orders_id, $bulk_rand));
             echo "<form method='post' name='order_reception_form{$suffix}{$bulk_rand}'
                           action='" . Toolbox::getItemTypeFormURL("PluginOrderReception") . "'>";
             if ($position == 'top') {

diff --git a/inc/reference_supplier.class.php b/inc/reference_supplier.class.php
@@ -350,11 +350,11 @@ public function showReferenceManufacturers($ID)
                 echo "<div class='center'>";
                 echo "<table width='900px' class='tab_glpi'>";
                 echo "<tr><td><i class='fas fa-level-up-alt fa-flip-horizontal fa-lg mx-2'></i></td>";
-                echo sprintf("<td class='center'><a onclick= \"if ( markCheckboxes('show_supplierref%d') ) ", $rand)
-                . "return false;\" href='#'>" . __s("Check all") . "</a></td>";
+                echo sprintf("<td class='center'><a data-order-mark-checkboxes='show_supplierref%d' href='#'>", $rand)
+                . __s("Check all") . "</a></td>";
 
-                echo sprintf("<td>/</td><td class='center'><a onclick= \"if ( unMarkCheckboxes('show_supplierref%d') ) ", $rand)
-                . "return false;\" href='#'>" . __s("Uncheck all") . "</a>";
+                echo sprintf("<td>/</td><td class='center'><a data-order-unmark-checkboxes='show_supplierref%d' href='#'>", $rand)
+                . __s("Uncheck all") . "</a>";
                 echo "</td><td align='left' width='80%'>";
                 echo "<input type='submit' name='delete' value=\"" . __s("Delete permanently")
                 . "\" class='submit' >";

diff --git a/inc/surveysupplier.class.php b/inc/surveysupplier.class.php
@@ -101,15 +101,13 @@ public function addNotation($field, $value)
         echo "</tr>";
         echo "</table>";
 
-        echo  "<script type='text/javascript'>\n";
-        echo sprintf("\$('#notation%d').rateit({value: '", $rand) . $value . "',
+        echo Html::scriptBlock(sprintf("\$('#notation%d').rateit({value: '", $rand) . $value . "',
                                 min : 0,
                                 max : 5,
                                 step: 1,
                                 backingfld: '#{$field}{$rand}',
                                 ispreset: true,
-                                resetable: false});";
-        echo "</script>";
+                                resetable: false});");
     }
 
 
@@ -474,10 +472,10 @@ public static function showOrderSupplierSurvey($ID)
                 echo "<tr>";
                 echo sprintf("<td><i class='%s fa-flip-horizontal fa-lg mx-2'></i></td>", $arrow);
                 echo "<td class='center' style='white-space:nowrap;'>";
-                echo sprintf("<a onclick= \"if ( markCheckboxes('%s') ) return false;\" href='#'>", $formname) . __s('Check all') . "</a></td>";
+                echo sprintf("<a data-order-mark-checkboxes='%s' href='#'>", htmlescape($formname)) . __s('Check all') . "</a></td>";
                 echo "<td>/</td>";
                 echo "<td class='center' style='white-space:nowrap;'>";
-                echo sprintf("<a onclick= \"if ( unMarkCheckboxes('%s') ) return false;\" href='#'>", $formname) . __s('Uncheck all') . "</a></td>";
+                echo sprintf("<a data-order-unmark-checkboxes='%s' href='#'>", htmlescape($formname)) . __s('Uncheck all') . "</a></td>";
                 echo "<td class='left' width='80%'>";
 
                 echo "<input type='submit' name='delete' ";

diff --git a/public/js/order.js b/public/js/order.js
@@ -0,0 +1,57 @@
+/**
+ * -------------------------------------------------------------------------
+ * Order plugin for GLPI
+ * -------------------------------------------------------------------------
+ *
+ * LICENSE
+ *
+ * This file is part of Order.
+ *
+ * Order is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Order is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Order. If not, see <http://www.gnu.org/licenses/>.
+ * -------------------------------------------------------------------------
+ * @copyright Copyright (C) 2009-2023 by Order plugin team.
+ * @license   GPLv3 https://www.gnu.org/licenses/gpl-3.0.html
+ * @link      https://github.com/pluginsGLPI/order
+ * -------------------------------------------------------------------------
+ */
+
+$(document).on('click', '[data-order-mark-checkboxes]', function (e) {
+    if (markCheckboxes($(this).attr('data-order-mark-checkboxes'))) {
+        e.preventDefault();
+    }
+});
+
+$(document).on('click', '[data-order-unmark-checkboxes]', function (e) {
+    if (unMarkCheckboxes($(this).attr('data-order-unmark-checkboxes'))) {
+        e.preventDefault();
+    }
+});
+
+$(document).on('click', '[data-order-show-div]', function (e) {
+    const root_doc = CFG_GLPI.root_doc;
+    showHideDiv(
+        $(this).attr('data-order-show-div'),
+        $(this).attr('data-order-show-img'),
+        root_doc + '/pics/plus.png',
+        root_doc + '/pics/moins.png'
+    );
+    e.preventDefault();
+});
+
+$(document).on('click', '[data-order-select-container]', function () {
+    selectNItems(
+        $(this).attr('data-order-select-container'),
+        $(this).attr('data-order-select-target')
+    );
+});
diff --git a/setup.php b/setup.php
@@ -198,6 +198,7 @@ function plugin_init_order()
         /*if glpi is loaded */
         if (Session::getLoginUserID()) {
             $PLUGIN_HOOKS['add_css']['order'][] = 'css/order.css';
+            $PLUGIN_HOOKS['add_javascript']['order'][] = 'js/order.js';
 
             /* link to the config page in plugins menu */
             if (Session::haveRight("config", UPDATE)) {
@@ -234,6 +235,7 @@ function plugin_version_order()
         'author'         => 'The plugin order team',
         'homepage'       => 'https://github.com/pluginsGLPI/order',
         'license'        => 'GPLv2+',
+        'csp_compliant'  => true,
         'requirements'   => [
             'glpi' => [
                 'min' => PLUGIN_ORDER_MIN_GLPI,