diff --git a/ChangeLog b/ChangeLog
index 00b44a08e2..84c9065af8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,6 +14,7 @@ phpMyAdmin - ChangeLog
 - issue #13167 Themes now have to contain metadata in theme.json
 - issue #6363  phpMyAdmin no longer requires eval() in PHP
 - issue #12386 The mbstring dependency is now optional
+- issue #13269 Small refactoring in preparation to CSP
 
 4.7.2 (not yet released)
 
diff --git a/templates/header_location.twig b/templates/header_location.twig
index 8925bd99f6..113dab3d30 100644
--- a/templates/header_location.twig
+++ b/templates/header_location.twig
@@ -8,7 +8,7 @@
     <meta http-equiv="Refresh" content="0;url={{ uri }}" />
     <script type="text/javascript">
         //<![CDATA[
-        setTimeout("window.location = decodeURI('{{ Sanitize_escapeJsString(uri) }}')", 2000);
+        setTimeout(function() { window.location = decodeURI('{{ Sanitize_escapeJsString(uri) }}'); }, 2000);
         //]]>
     </script>
 </head>
diff --git a/test/libraries/core/PMA_headerLocation_test.php b/test/libraries/core/PMA_headerLocation_test.php
index 046acc1c06..adb760f168 100644
--- a/test/libraries/core/PMA_headerLocation_test.php
+++ b/test/libraries/core/PMA_headerLocation_test.php
@@ -117,7 +117,7 @@ class PMA_HeaderLocation_Test extends PMATestCase
             . "\n    <meta http-equiv=\"Cache-Control\" content=\"no-cache\" />"
             . "\n    <meta http-equiv=\"Refresh\" content=\"0;url=" . $testUri_html . "\" />"
             . "\n    <script type=\"text/javascript\">\n        //<![CDATA[
-        setTimeout(\"window.location = decodeURI('" . $testUri_js . "')\", 2000);
+        setTimeout(function() { window.location = decodeURI('" . $testUri_js . "'); }, 2000);
         //]]>\n    </script>\n</head>
 <body>\n<script type=\"text/javascript\">\n    //<![CDATA[
     document.write('<p><a href=\"" . $testUri_html . "\">" . __('Go') . "</a></p>');
