fulldecent/freescout-sidebar-webhook
Ver no GitHubEasy way to allow scripts execution?
Open
#14 aberto em 27 de jan. de 2025
help wanted
Métricas do repositório
- Stars
- (32 stars)
- Métricas de merge de PR
- (Métricas PR pendentes)
Description
Hi there, in my company we have a widget (provided by a WordPress plugin) that we use both with freescout and helpscout. Its html contains some scripts that we'd like to be executed on freescout. Due to the freescout restrictions that's not possible unless the correct nonce attribute is added to the script elements. So my idea was to replace this line:
with this code:
const cspString = $('meta[http-equiv="Content-Security-Policy"]').attr('content');
const nonce = cspString.match(/nonce-([^']+)/)[1];
$('#swh-content').html(response.html.replace(/{{nonce}}/g, `nonce="${nonce}"`));
with the webhook server responding with an html like:
[...]
<script type="module" {{nonce}}>
<?php echo file_get_contents($js_file); ?>
</script>
[...]
what do you think? do you have a better way to do that? And/Or, are you interested into implementing it in your module?
Thank you so much!