From 53f18ca6ee866a71038a87c3bf431d476ebdef2c Mon Sep 17 00:00:00 2001
From: Victor_Jay <ovoex.cn@gmail.com>
Date: Tue, 2 Jun 2026 16:10:23 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CSP=20=E7=AD=96=E7=95=A5=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=20unsafe-inline=EF=BC=8C=E6=94=B9=E7=94=A8=20nonce=20?=
 =?UTF-8?q?=E6=9C=BA=E5=88=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- SecurityHeaders 中间件生成随机 nonce，注入 context
- BuildPageData/BuildAdminPageData 将 CSPNonce 传递给模板
- 所有 19 个模板文件 <script> 标签添加 nonce 属性
- 移除所有内联事件处理（onclick/onerror），改用事件监听
- 移除所有 javascript:void(0) 链接，改用 # 号 + preventDefault
- utils.js 添加全局 avatar 图片加载失败回退处理
- common.js 登出按钮添加 preventDefault
- audit.js 关闭弹窗按钮改用事件监听
---
 internal/common/helper.go                     |  4 +++
 internal/middleware/security.go               | 23 +++++++++++++---
 templates/MetaLab-2026/html/auth/login.html   |  4 +--
 .../MetaLab-2026/html/auth/register.html      |  6 ++---
 templates/MetaLab-2026/html/home/index.html   |  4 +--
 .../MetaLab-2026/html/layout/header.html      |  2 +-
 templates/MetaLab-2026/html/layout/nav.html   |  6 ++---
 .../MetaLab-2026/html/messages/index.html     |  4 +--
 templates/MetaLab-2026/html/posts/404.html    |  2 +-
 templates/MetaLab-2026/html/posts/index.html  |  2 +-
 templates/MetaLab-2026/html/posts/show.html   | 18 ++++++-------
 .../MetaLab-2026/html/settings/index.html     |  4 +--
 templates/MetaLab-2026/html/space/index.html  | 26 ++++++++++++++-----
 .../MetaLab-2026/html/studio/analytics.html   |  4 +--
 .../MetaLab-2026/html/studio/drafts.html      | 19 +++++++++++---
 templates/MetaLab-2026/html/studio/posts.html | 12 +++++++--
 templates/MetaLab-2026/html/studio/write.html |  6 ++---
 templates/MetaLab-2026/static/js/common.js    |  3 ++-
 templates/admin/html/audit/index.html         |  4 +--
 templates/admin/html/comments/index.html      |  2 +-
 templates/admin/html/layout/footer.html       |  6 ++---
 templates/admin/html/posts/index.html         |  2 +-
 templates/admin/html/users/index.html         |  2 +-
 templates/admin/static/js/audit.js            |  2 ++
 templates/shared/static/js/utils.js           | 10 +++++++
 25 files changed, 122 insertions(+), 55 deletions(-)

diff --git a/internal/common/helper.go b/internal/common/helper.go
index 7ba88d1..3caa040 100644
--- a/internal/common/helper.go
+++ b/internal/common/helper.go
@@ -82,6 +82,10 @@ func BuildPageData(c *gin.Context, extra gin.H) gin.H {
 	for k, v := range extra {
 		data[k] = v
 	}
+	// 注入 CSP nonce（由 SecurityHeaders 中间件生成）
+	if nonce, exists := c.Get("csp_nonce"); exists {
+		data["CSPNonce"] = nonce
+	}
 	if username, exists := c.Get("username"); exists {
 		data["IsLoggedIn"] = true
 		data["Username"] = username
diff --git a/internal/middleware/security.go b/internal/middleware/security.go
index 7698c6e..cab764d 100644
--- a/internal/middleware/security.go
+++ b/internal/middleware/security.go
@@ -1,20 +1,37 @@
 package middleware
 
 import (
+	"crypto/rand"
+	"encoding/base64"
+
 	"github.com/gin-gonic/gin"
 )
 
+// generateNonce 生成 16 字节随机 nonce（base64 编码）
+func generateNonce() string {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		// 降级：使用固定长度回退（极度罕见，仅 /dev/urandom 故障时）
+		panic("failed to generate CSP nonce: " + err.Error())
+	}
+	return base64.StdEncoding.EncodeToString(b)
+}
+
 // SecurityHeaders 添加安全相关 HTTP 响应头
 // 作为纵深防御，不影响业务逻辑，纯附加
 func SecurityHeaders() gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// 生成一次性 nonce，用于 CSP 策略和模板内 <script>/<style> 标签
+		nonce := generateNonce()
+		c.Set("csp_nonce", nonce)
+
 		// Content-Security-Policy
-		// script-src/style-src: 本站 + inline（highlight.js 主题已本地化在 static/vditor/ 下）
+		// script-src/style-src: 本站 + nonce（替代 unsafe-inline）
 		// img-src: 本站 + data: URI（头像裁切）+ blob:（粘贴图片）
 		c.Header("Content-Security-Policy",
 			"default-src 'self'; "+
-				"script-src 'self' 'unsafe-inline'; "+
-				"style-src 'self' 'unsafe-inline'; "+
+				"script-src 'self' 'nonce-"+nonce+"'; "+
+				"style-src 'self' 'nonce-"+nonce+"'; "+
 				"img-src 'self' data: blob:; "+
 				"connect-src 'self'")
 
diff --git a/templates/MetaLab-2026/html/auth/login.html b/templates/MetaLab-2026/html/auth/login.html
index f3249fa..a5f93de 100644
--- a/templates/MetaLab-2026/html/auth/login.html
+++ b/templates/MetaLab-2026/html/auth/login.html
@@ -42,7 +42,7 @@
     <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="12" y1="19" x2="12" y2="5"/><polyline points="5 12 12 5 19 12"/></svg>
 </button>
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/login.js?v={{assetV "/static/js/login.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/login.js?v={{assetV "/static/js/login.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/auth/register.html b/templates/MetaLab-2026/html/auth/register.html
index e1c1350..525082a 100644
--- a/templates/MetaLab-2026/html/auth/register.html
+++ b/templates/MetaLab-2026/html/auth/register.html
@@ -38,7 +38,7 @@
                 </label>
                 <span class="remember-hint">非共享设备推荐</span>
             </div>
-            <p class="guidelines-link">点击注册即表示同意 <a href="javascript:void(0)" id="openGuidelines">《MetaLab 社区用户准则》</a></p>
+            <p class="guidelines-link">点击注册即表示同意 <a href="#" id="openGuidelines">《MetaLab 社区用户准则》</a></p>
             <button type="submit" class="submit-btn" id="submitBtn">注 册</button>
         </form>
         {{else}}
@@ -89,7 +89,7 @@
     <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><line x1="12" y1="19" x2="12" y2="5"/><polyline points="5 12 12 5 19 12"/></svg>
 </button>
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/register.js?v={{assetV "/static/js/register.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/register.js?v={{assetV "/static/js/register.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/home/index.html b/templates/MetaLab-2026/html/home/index.html
index 4bf3a6d..c04a0fb 100644
--- a/templates/MetaLab-2026/html/home/index.html
+++ b/templates/MetaLab-2026/html/home/index.html
@@ -64,7 +64,7 @@
             <div class="sidebar-card user-card">
                 {{if .IsLoggedIn}}
                 {{if .Avatar}}
-                <img src="{{.Avatar}}" alt="{{.Username}}" class="user-avatar-img" onerror="this.style.display='none';this.nextElementSibling.style.display='flex'">
+                <img src="{{.Avatar}}" alt="{{.Username}}" class="user-avatar-img">
                 <div class="user-avatar-fallback" style="display:none">{{substr .Username 0 1}}</div>
                 {{else}}
                 <div class="user-avatar-fallback">{{substr .Username 0 1}}</div>
@@ -117,6 +117,6 @@
 
 {{template "layout/footer.html" .}}
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/layout/header.html b/templates/MetaLab-2026/html/layout/header.html
index 52caf11..4c1ce75 100644
--- a/templates/MetaLab-2026/html/layout/header.html
+++ b/templates/MetaLab-2026/html/layout/header.html
@@ -20,5 +20,5 @@
 {{if .ExtraCSS2}}
 <link rel="stylesheet" href="{{.ExtraCSS2}}?v={{assetV .ExtraCSS2}}">
 {{end}}
-<script src="/shared/static/js/utils.js?v={{assetV "/shared/static/js/utils.js"}}"></script>
+<script src="/shared/static/js/utils.js?v={{assetV "/shared/static/js/utils.js"}}" nonce="{{.CSPNonce}}"></script>
 </head>
diff --git a/templates/MetaLab-2026/html/layout/nav.html b/templates/MetaLab-2026/html/layout/nav.html
index 0e809ec..eed73db 100644
--- a/templates/MetaLab-2026/html/layout/nav.html
+++ b/templates/MetaLab-2026/html/layout/nav.html
@@ -20,7 +20,7 @@
             <li class="nav-avatar-wrapper">
                 <a href="/space" class="nav-avatar-link">
                     {{if .Avatar}}
-                    <img src="{{.Avatar}}" alt="" class="nav-avatar" onerror="this.style.display='none';this.nextElementSibling.style.display='flex'">
+                    <img src="{{.Avatar}}" alt="" class="nav-avatar">
                     <span class="nav-avatar nav-avatar-default" style="display:none">{{substr .Username 0 1}}</span>
                     {{else}}
                     <span class="nav-avatar nav-avatar-default">{{substr .Username 0 1}}</span>
@@ -30,7 +30,7 @@
                     <div class="nav-dropdown-header">
                         <div class="nav-dropdown-avatar">
                             {{if .Avatar}}
-                            <img src="{{.Avatar}}" alt="" onerror="this.style.display='none';this.nextElementSibling.style.display='flex'">
+                            <img src="{{.Avatar}}" alt="">
                             <span style="display:none">{{substr .Username 0 1}}</span>
                             {{else}}
                             <span>{{substr .Username 0 1}}</span>
@@ -47,7 +47,7 @@
                         <svg class="nav-dropdown-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
                         <span>个人中心</span>
                     </a>
-                    <a href="javascript:void(0)" class="nav-dropdown-item nav-logout" id="logoutBtn">
+                    <a href="#" class="nav-dropdown-item nav-logout" id="logoutBtn">
                         <svg class="nav-dropdown-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"/><polyline points="16 17 21 12 16 7"/><line x1="21" y1="12" x2="9" y2="12"/></svg>
                         <span>退出登录</span>
                     </a>
diff --git a/templates/MetaLab-2026/html/messages/index.html b/templates/MetaLab-2026/html/messages/index.html
index 0348e8f..86dd26b 100644
--- a/templates/MetaLab-2026/html/messages/index.html
+++ b/templates/MetaLab-2026/html/messages/index.html
@@ -117,7 +117,7 @@
 </main>
 
 {{template "layout/footer.html" .}}
-<script>
+<script nonce="{{.CSPNonce}}">
 (function () {
     'use strict';
 
@@ -230,6 +230,6 @@
     }
 })();
 </script>
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/posts/404.html b/templates/MetaLab-2026/html/posts/404.html
index 921cbc3..9fe4ef6 100644
--- a/templates/MetaLab-2026/html/posts/404.html
+++ b/templates/MetaLab-2026/html/posts/404.html
@@ -17,6 +17,6 @@
     </div>
 </div>
 {{template "layout/footer.html" .}}
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/posts/index.html b/templates/MetaLab-2026/html/posts/index.html
index 76a3c2a..df5793c 100644
--- a/templates/MetaLab-2026/html/posts/index.html
+++ b/templates/MetaLab-2026/html/posts/index.html
@@ -50,6 +50,6 @@
 
 {{template "layout/footer.html" .}}
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/html/posts/show.html b/templates/MetaLab-2026/html/posts/show.html
index bbf7566..14ff0b5 100644
--- a/templates/MetaLab-2026/html/posts/show.html
+++ b/templates/MetaLab-2026/html/posts/show.html
@@ -146,10 +146,10 @@
 <textarea id="postMdContent" style="display:none">{{.Post.Body}}</textarea>
 
 <link rel="stylesheet" href="/static/vditor/dist/index.css?v={{assetV "/static/vditor/dist/index.css"}}">
-<script src="/static/vditor/dist/method.min.js?v={{assetV "/static/vditor/dist/method.min.js"}}"></script>
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/shortcode.js?v={{assetV "/static/js/shortcode.js"}}"></script>
-<script>
+<script src="/static/vditor/dist/method.min.js?v={{assetV "/static/vditor/dist/method.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/shortcode.js?v={{assetV "/static/js/shortcode.js"}}" nonce="{{.CSPNonce}}"></script>
+<script nonce="{{.CSPNonce}}">
 (function() {
     var el = document.getElementById('postContent');
     var mdEl = document.getElementById('postMdContent');
@@ -180,7 +180,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // 提交审核按钮
 (function() {
     var btn = document.getElementById('submitAuditBtn');
@@ -205,7 +205,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // 赋能按钮 + 弹窗
 (function() {
     var btn = document.getElementById('energizeBtn');
@@ -287,7 +287,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 赞/踩系统 ==========
 (function() {
     var container = document.getElementById('postReactions');
@@ -363,7 +363,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 收藏按钮（弹窗选择收藏夹）==========
 (function() {
     var favBtn = document.getElementById('favBtn');
@@ -614,7 +614,7 @@
 })();
 </script>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 // ========== 评论系统 ==========
 (function() {
     var commentsSection = document.getElementById('comments');
diff --git a/templates/MetaLab-2026/html/settings/index.html b/templates/MetaLab-2026/html/settings/index.html
index e261153..f6f65af 100644
--- a/templates/MetaLab-2026/html/settings/index.html
+++ b/templates/MetaLab-2026/html/settings/index.html
@@ -328,8 +328,8 @@
     </div>
 </div>
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script nonce="{{.CSPNonce}}">
 (function () {
     'use strict';
 
diff --git a/templates/MetaLab-2026/html/space/index.html b/templates/MetaLab-2026/html/space/index.html
index 0b327de..ff8a347 100644
--- a/templates/MetaLab-2026/html/space/index.html
+++ b/templates/MetaLab-2026/html/space/index.html
@@ -338,18 +338,18 @@
         {{if eq .ActiveTab "collections"}}
         <!-- 左侧收藏夹列表 -->
         <aside class="space-sidebar collection-sidebar">
-            <h2 class="space-sidebar-title collapsible" onclick="toggleFolderSection(this)">
+            <h2 class="space-sidebar-title collapsible" id="folderSectionToggle">
                 我创建的收藏夹
                 <svg class="collapse-arrow" viewBox="0 0 24 24" width="16" height="16"><path fill="currentColor" d="M7.41 8.59L12 13.17l4.59-4.58L18 10l-6 6-6-6 1.41-1.41z"/></svg>
             </h2>
             <nav class="space-sidebar-nav" id="folder-nav">
-                <a href="javascript:void(0)" class="space-sidebar-link new-folder-btn" onclick="showNewFolderInput()">
+                <a href="#" class="space-sidebar-link new-folder-btn" id="showNewFolderBtn">
                     <svg viewBox="0 0 24 24" width="16" height="16"><path fill="currentColor" d="M19 13h-6v6h-2v-6H5v-2h6V5h2v6h6v2z"/></svg>
                     新建收藏夹
                 </a>
                 <div id="new-folder-input" style="display:none;">
                     <input type="text" id="new-folder-name" placeholder="收藏夹名称" maxlength="50" class="new-folder-input">
-                    <button onclick="createFolder()" class="new-folder-submit">确定</button>
+                    <button id="createFolderBtn" class="new-folder-submit">确定</button>
                 </div>
                 {{if .FoldersResult}}
                 {{range $f := .FoldersResult.Folders}}
@@ -576,11 +576,11 @@
 
 {{template "layout/footer.html" .}}
 
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 
 <!-- 访客空间：关注按钮交互 -->
 {{if and (not .IsOwnSpace) (or (eq .ActiveTab "following") (eq .ActiveTab "followers"))}}
-<script>
+<script nonce="{{.CSPNonce}}">
 (function() {
     var cards = document.querySelectorAll('.space-user-card');
     if (!cards.length) return;
@@ -678,7 +678,7 @@
 
 <!-- 收藏夹交互脚本 -->
 {{if eq .ActiveTab "collections"}}
-<script>
+<script nonce="{{.CSPNonce}}">
 function toggleFolderSection(el) {
     el.parentElement.querySelector('#folder-nav').classList.toggle('collapsed');
     el.classList.toggle('collapsed');
@@ -701,6 +701,18 @@ function createFolder() {
     });
 }
 
+// 事件绑定（替代内联 onclick，满足 CSP 无 unsafe-inline）
+document.addEventListener('DOMContentLoaded', function() {
+    var toggle = document.getElementById('folderSectionToggle');
+    if (toggle) toggle.addEventListener('click', function() { toggleFolderSection(this); });
+
+    var showBtn = document.getElementById('showNewFolderBtn');
+    if (showBtn) showBtn.addEventListener('click', function(e) { e.preventDefault(); showNewFolderInput(); });
+
+    var createBtn = document.getElementById('createFolderBtn');
+    if (createBtn) createBtn.addEventListener('click', function() { createFolder(); });
+});
+
 // 隐私开关变更保存
 document.querySelectorAll('.privacy-settings-grid .toggle-switch input').forEach(function(cb) {
     cb.addEventListener('change', function() {
@@ -712,7 +724,7 @@ document.querySelectorAll('.privacy-settings-grid .toggle-switch input').forEach
 
 <!-- 设置页交互脚本 -->
 {{if eq .ActiveTab "settings"}}
-<script>
+<script nonce="{{.CSPNonce}}">
 // 隐私开关变更时自动保存到后端
 document.querySelectorAll('#privacy-follow-list, #privacy-follower-list').forEach(function(cb) {
     cb.addEventListener('change', function() {
diff --git a/templates/MetaLab-2026/html/studio/analytics.html b/templates/MetaLab-2026/html/studio/analytics.html
index bbf2dc2..4036c2a 100644
--- a/templates/MetaLab-2026/html/studio/analytics.html
+++ b/templates/MetaLab-2026/html/studio/analytics.html
@@ -86,8 +86,8 @@
 
 {{template "layout/footer.html" .}}
 
-<script src="/static/js/chart.umd.min.js?v={{assetV "/static/js/chart.umd.min.js"}}"></script>
-<script>
+<script src="/static/js/chart.umd.min.js?v={{assetV "/static/js/chart.umd.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script nonce="{{.CSPNonce}}">
 (function () {
     'use strict';
 
diff --git a/templates/MetaLab-2026/html/studio/drafts.html b/templates/MetaLab-2026/html/studio/drafts.html
index 5c36091..4d8d1e7 100644
--- a/templates/MetaLab-2026/html/studio/drafts.html
+++ b/templates/MetaLab-2026/html/studio/drafts.html
@@ -28,8 +28,8 @@
                 </div>
                 <div class="post-item-actions">
                     <a href="/studio/write?id={{.ID}}" class="action-btn primary">继续编辑</a>
-                    <button class="action-btn" onclick="submitPost({{.ID}})" title="提交发布">提交</button>
-                    <button class="action-btn danger" onclick="deletePost({{.ID}})" title="删除">删除</button>
+                    <button class="action-btn" data-post-id="{{.ID}}" data-action="submit" title="提交发布">提交</button>
+                    <button class="action-btn danger" data-post-id="{{.ID}}" data-action="delete" title="删除">删除</button>
                 </div>
             </div>
             {{end}}
@@ -57,7 +57,7 @@
     </main>
 </div>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 function submitPost(id) {
     if (!confirm('确定要提交这篇草稿进行审核吗？')) return;
 
@@ -97,6 +97,19 @@ function deletePost(id) {
         }
     });
 }
+
+// 事件委托代替内联 onclick（满足 CSP 无 unsafe-inline）
+document.addEventListener('click', function(e) {
+    var btn = e.target.closest('[data-action]');
+    if (!btn) return;
+    var id = btn.getAttribute('data-post-id');
+    var action = btn.getAttribute('data-action');
+    if (action === 'delete') {
+        deletePost(id);
+    } else if (action === 'submit') {
+        submitPost(id);
+    }
+});
 </script>
 
 {{template "layout/footer.html" .}}
diff --git a/templates/MetaLab-2026/html/studio/posts.html b/templates/MetaLab-2026/html/studio/posts.html
index c77d343..4f1f1cc 100644
--- a/templates/MetaLab-2026/html/studio/posts.html
+++ b/templates/MetaLab-2026/html/studio/posts.html
@@ -49,7 +49,7 @@
                 <div class="post-item-actions">
                     {{if not .IsLocked}}<a href="/studio/write?id={{.ID}}" class="action-btn">编辑</a>{{end}}
                     <a href="/posts/{{.ID}}" target="_blank" class="action-btn">查看</a>
-                    <button class="action-btn danger" onclick="deletePost({{.ID}})" title="删除">删除</button>
+                    <button class="action-btn danger" data-post-id="{{.ID}}" data-action="delete" title="删除">删除</button>
                 </div>
             </div>
             {{end}}
@@ -78,7 +78,7 @@
     </main>
 </div>
 
-<script>
+<script nonce="{{.CSPNonce}}">
 function deletePost(id) {
     if (!confirm('确定要删除这篇文章吗？')) return;
 
@@ -98,6 +98,14 @@ function deletePost(id) {
         }
     });
 }
+
+// 事件委托代替内联 onclick（满足 CSP 无 unsafe-inline）
+document.addEventListener('click', function(e) {
+    var btn = e.target.closest('[data-action="delete"]');
+    if (btn) {
+        deletePost(btn.getAttribute('data-post-id'));
+    }
+});
 </script>
 
 {{template "layout/footer.html" .}}
diff --git a/templates/MetaLab-2026/html/studio/write.html b/templates/MetaLab-2026/html/studio/write.html
index 4f61d1f..5476148 100644
--- a/templates/MetaLab-2026/html/studio/write.html
+++ b/templates/MetaLab-2026/html/studio/write.html
@@ -95,8 +95,8 @@
 {{template "layout/footer.html" .}}
 
 <link rel="stylesheet" href="/static/vditor/dist/index.css?v={{assetV "/static/vditor/dist/index.css"}}">
-<script src="/static/vditor/dist/index.min.js?v={{assetV "/static/vditor/dist/index.min.js"}}"></script>
-<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}"></script>
-<script src="/static/js/studio-editor.js?v={{assetV "/static/js/studio-editor.js"}}"></script>
+<script src="/static/vditor/dist/index.min.js?v={{assetV "/static/vditor/dist/index.min.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/common.js?v={{assetV "/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/static/js/studio-editor.js?v={{assetV "/static/js/studio-editor.js"}}" nonce="{{.CSPNonce}}"></script>
 </body>
 </html>
diff --git a/templates/MetaLab-2026/static/js/common.js b/templates/MetaLab-2026/static/js/common.js
index 3dbc8dc..8283790 100644
--- a/templates/MetaLab-2026/static/js/common.js
+++ b/templates/MetaLab-2026/static/js/common.js
@@ -258,7 +258,8 @@
     // ---- Logout ----
     var logoutBtn = document.getElementById('logoutBtn');
     if (logoutBtn) {
-        logoutBtn.addEventListener('click', function () {
+        logoutBtn.addEventListener('click', function (e) {
+            e.preventDefault();
             var xhr = new XMLHttpRequest();
             xhr.open('POST', '/api/auth/logout', true);
             xhr.onreadystatechange = function () {
diff --git a/templates/admin/html/audit/index.html b/templates/admin/html/audit/index.html
index e4a2cb1..88ad90b 100644
--- a/templates/admin/html/audit/index.html
+++ b/templates/admin/html/audit/index.html
@@ -92,12 +92,12 @@
                 <p>请填写拒绝理由：</p>
                 <textarea id="rejectReason" rows="3" maxlength="500" placeholder="请输入拒绝理由..."></textarea>
                 <div class="modal-actions">
-                    <button class="btn btn-outline" onclick="closeRejectModal()">取消</button>
+                    <button class="btn btn-outline" id="closeRejectModalBtn">取消</button>
                     <button class="btn btn-danger" id="confirmRejectBtn">确认拒绝</button>
                 </div>
             </div>
         </div>
-<script>
+<script nonce="{{.CSPNonce}}">
 window.__AUDIT_TYPES = {
     {{range $val, $label := .AuditTypes}}"{{$val}}": "{{$label}}",
     {{end}}
diff --git a/templates/admin/html/comments/index.html b/templates/admin/html/comments/index.html
index 80f2c3b..63bc8f5 100644
--- a/templates/admin/html/comments/index.html
+++ b/templates/admin/html/comments/index.html
@@ -30,4 +30,4 @@
 <div class="admin-loading" id="commentLoading" style="display:none">加载中...</div>
 
 {{template "admin/layout/footer.html" .}}
-<script src="/admin/static/js/comments.js?v={{assetV "/admin/static/js/comments.js"}}"></script>
+<script src="/admin/static/js/comments.js?v={{assetV "/admin/static/js/comments.js"}}" nonce="{{.CSPNonce}}"></script>
diff --git a/templates/admin/html/layout/footer.html b/templates/admin/html/layout/footer.html
index 0888180..02684c5 100644
--- a/templates/admin/html/layout/footer.html
+++ b/templates/admin/html/layout/footer.html
@@ -1,9 +1,9 @@
     </main>
 </div>
-<script src="/shared/static/js/utils.js?v={{assetV "/shared/static/js/utils.js"}}"></script>
-<script src="/admin/static/js/common.js?v={{assetV "/admin/static/js/common.js"}}"></script>
+<script src="/shared/static/js/utils.js?v={{assetV "/shared/static/js/utils.js"}}" nonce="{{.CSPNonce}}"></script>
+<script src="/admin/static/js/common.js?v={{assetV "/admin/static/js/common.js"}}" nonce="{{.CSPNonce}}"></script>
 {{if .ExtraJS}}
-<script src="{{.ExtraJS}}"></script>
+<script src="{{.ExtraJS}}" nonce="{{.CSPNonce}}"></script>
 {{end}}
 </body>
 </html>
diff --git a/templates/admin/html/posts/index.html b/templates/admin/html/posts/index.html
index 55b237f..45b131f 100644
--- a/templates/admin/html/posts/index.html
+++ b/templates/admin/html/posts/index.html
@@ -82,5 +82,5 @@
         </div>
         {{end}}
 
-<script src="/admin/static/js/posts.js?v={{assetV "/admin/static/js/posts.js"}}"></script>
+<script src="/admin/static/js/posts.js?v={{assetV "/admin/static/js/posts.js"}}" nonce="{{.CSPNonce}}"></script>
 {{template "admin/layout/footer.html" .}}
diff --git a/templates/admin/html/users/index.html b/templates/admin/html/users/index.html
index 738c28c..414155f 100644
--- a/templates/admin/html/users/index.html
+++ b/templates/admin/html/users/index.html
@@ -44,7 +44,7 @@
 
         <!-- 分页 -->
         <div class="pagination-bar" id="paginationBar"></div>
-<script>
+<script nonce="{{.CSPNonce}}">
 window.__currentUid = {{.UID}};
 window.__isOwner = {{if .IsOwner}}true{{else}}false{{end}};
 // 由服务端 model.RoleDisplayNames / StatusDisplayNames 作为唯一数据源注入
diff --git a/templates/admin/static/js/audit.js b/templates/admin/static/js/audit.js
index 00269d7..3a23ea6 100644
--- a/templates/admin/static/js/audit.js
+++ b/templates/admin/static/js/audit.js
@@ -217,6 +217,8 @@ function closeRejectModal() {
     document.getElementById('rejectModal').style.display = 'none';
 }
 
+document.getElementById('closeRejectModalBtn').addEventListener('click', closeRejectModal);
+
 document.getElementById('confirmRejectBtn').addEventListener('click', async () => {
     const reason = document.getElementById('rejectReason').value.trim();
     if (!reason) {
diff --git a/templates/shared/static/js/utils.js b/templates/shared/static/js/utils.js
index dfad8d8..09ef3ac 100644
--- a/templates/shared/static/js/utils.js
+++ b/templates/shared/static/js/utils.js
@@ -12,3 +12,13 @@ function getCSRFToken() {
     var meta = document.querySelector('meta[name="csrf-token"]');
     return meta ? meta.getAttribute('content') : '';
 }
+
+// 全局头像图片加载失败回退（替代 onerror 内联事件，满足 CSP 无 unsafe-inline）
+document.addEventListener('error', function(e) {
+    var img = e.target;
+    if (img && img.tagName === 'IMG' && (img.classList.contains('nav-avatar') || img.classList.contains('user-avatar-img'))) {
+        img.style.display = 'none';
+        var next = img.nextElementSibling;
+        if (next) next.style.display = 'flex';
+    }
+}, true);