introduce a template function to output a inline script

This handles the output of a potentially available nonce.

Author: splitbrain

inc/Ui/Editor.php

@@ -150,7 +150,7 @@ public function show()
         // start editor html output
         if ($wr) {
             // sets changed to true when previewed
-            echo '<script>/*<![CDATA[*/textChanged = ' . ($mod ? 'true' : 'false') . '/*!]]>*/</script>';
+            tpl_inlineScript('textChanged = ' . ($mod ? 'true' : 'false') . ';');
         }
 
         // print intro locale text (edit, rditrev, or read.txt)

inc/template.php

@@ -440,6 +440,30 @@ function _tpl_metaheaders_action($data)
     }
 }
 
+/**
+ * Output the given script as inline script tag
+ *
+ * This function will add the nonce attribute if a nonce is available.
+ *
+ * The script is NOT automatically escaped!
+ *
+ * @param string $script
+ * @param bool $return Return or print directly?
+ * @return string|void
+ */
+function tpl_inlineScript($script, $return = false)
+{
+    $nonce = getenv('NONCE');
+    if ($nonce) {
+        $script = '<script nonce="' . $nonce . '">' . $script . '</script>';
+    } else {
+        $script = '<script>' . $script . '</script>';
+    }
+
+    if ($return) return $script;
+    echo $script;
+}
+
 /**
  * Print a link
  *