fulldecent/freescout-sidebar-webhook
Voir sur GitHubEasy way to allow scripts execution?
Open
#14 ouverte le 27 janv. 2025
help wanted
Métriques du dépôt
- Stars
- (32 stars)
- Métriques de merge PR
- (Métriques PR en attente)
Description
Hi there, in my company we have a widget (provided by a WordPress plugin) that we use both with freescout and helpscout. Its html contains some scripts that we'd like to be executed on freescout. Due to the freescout restrictions that's not possible unless the correct nonce attribute is added to the script elements. So my idea was to replace this line:
with this code:
const cspString = $('meta[http-equiv="Content-Security-Policy"]').attr('content');
const nonce = cspString.match(/nonce-([^']+)/)[1];
$('#swh-content').html(response.html.replace(/{{nonce}}/g, `nonce="${nonce}"`));
with the webhook server responding with an html like:
[...]
<script type="module" {{nonce}}>
<?php echo file_get_contents($js_file); ?>
</script>
[...]
what do you think? do you have a better way to do that? And/Or, are you interested into implementing it in your module?
Thank you so much!