Matt Westcott

With #4583 merged, we've hopefully eliminated all uses of `eval` - would be keen to hear from people implementing CSP about whether there are any other significant blockers remaining.

@robvdl Are you testing against current master? The issue with modals should have been fixed by #4583 (which will be in Wagtail 2.2).

@SaptakS The upcoming redevelopment of StreamField (https://wagtail.io/blog/telepath/, https://github.com/gasman/telepath-poc) is going to adopt an approach that avoids inline `` tags, but we're a long way off eliminating them from Wagtail entirely...

Related: #10754 (and to some extent #10496). These all stem from the fact that the chooser popup was designed to be a mechanism to get values into the panel, rather...

@noobCoderVP You're welcome to give it a go, but I don't think this is going to be a straightforward fix. You can replicate this on the [bakerydemo](https://github.com/wagtail/bakerydemo) project - the...

@noobCoderVP The point about duplicates is covered in a separate issue: #10496. As mentioned there, there are situations where we _do_ want to allow duplicates: for example, if you're building...

I don't use Docker for Wagtail development myself, but https://github.com/wagtail/docker-wagtail-develop should allow you to set up a development environment.

I did say up-front it probably wouldn't be a straightforward fix! You might be able to get some further pointers in the **#new-contributors** channel on [the Wagtail Slack](https://github.com/wagtail/wagtail/wiki/Slack).

I wouldn't be opposed to moving the contents of `_editor_js.html` into the base template - along with the appropriate cleanup (such as eliminating places where pages import things like `modal-workflow.js`...

@sagamusix Not really - `telnet://` is something that we can pattern-match for, like we do for other 'recognised' link types. It doesn't require a manually-entered label, which is what #414...