Created full_page_spinner.js file + added permit for expected saved s…

…ettings request parameters

apps/dashboard/app/controllers/batch_connect/settings_controller.rb

@@ -8,8 +8,9 @@ def show
     set_app_groups
     set_saved_settings
 
-    app_token = params[:token]
-    settings_name = params[:id]
+    settings_params = settings_request_params
+    app_token = settings_params[:token]
+    settings_name = settings_params[:id]
     settings_values = bc_templates(app_token).fetch(settings_name.to_sym, {})
     @settings = BatchConnect::Settings.new(app_token, settings_name, settings_values)
     if @settings.outdated?
@@ -19,15 +20,20 @@ def show
 
   # DELETE /batch_connect/<app_token>/settings/<settings_name>
   def destroy
-    app_token = params[:token]
-    settings_name = params[:id]
+    settings_params = settings_request_params
+    app_token = settings_params[:token]
+    settings_name = settings_params[:id]
     delete_bc_template(app_token, settings_name)
     redirect_to new_batch_connect_session_context_path(token: app_token),
                 notice: t('dashboard.bc_saved_settings.deleted_message', settings_name: settings_name)
   end
 
   private
 
+  def settings_request_params
+    params.permit(:token, :id)
+  end
+
   # Set the all the saved settings to render the navigation
   def set_saved_settings
     @bc_saved_settings = all_bc_templates

apps/dashboard/app/javascript/full_page_spinner.js

@@ -0,0 +1,10 @@
+jQuery(function (){
+    function showSpinner() {
+        $('body').addClass('modal-open');
+        $('#full-page-spinner').removeClass('d-none');
+    }
+
+    $('.full-page-spinner').each((index, element) => {
+        $(element).closest('form').on('submit', showSpinner);
+    });
+});

apps/dashboard/app/views/batch_connect/shared/_full_page_spinner.html.erb

@@ -1,15 +1,6 @@
-<script nonce="<%= content_security_policy_nonce %>">
-jQuery(function (){
-    function showSpinner() {
-        $('body').addClass('modal-open');
-        $('#full-page-spinner').removeClass('d-none');
-    }
-
-    $('.full-page-spinner').each((index, element) => {
-        $(element).closest('form').on('submit', showSpinner);
-    });
-});
-</script>
+<%- content_for :head do -%>
+  <%= javascript_include_tag('full_page_spinner', nonce: true) %>
+<%- end -%>
 <div id="full-page-spinner" class="d-none">
   <div class="spinner-border" role="status"></div>
 </div>