remove inline javascript

[nodiscc]

It would be great to move inline javascript (for example https://github.com/shaarli/Shaarli/blob/master/tpl/linklist.html#L70 ) to their own .js files. Inline javascript does not run when the server has strict Content Security Policy (CSP) settings (good practice).

Firefox console returns:

Content Security Policy: Les paramètres de la page ont empêché le chargement d'une ressource à self (« script-src https://my.shaarli.url »)

Eg. for apache2 Header set Content-Security-Policy "script-src 'self'" prevents qr code/tag autocomplete/... from running. Header set Content-Security-Policy "script-src 'self' 'unsafe-inline'" allows it, but is less safe.