fulldecent / fulldecent/freescout-sidebar-webhook
Easy way to allow scripts execution?
- Dominant language
- PHP
- Stars
- 35
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
Hi there,
in my company we have a widget (provided by a WordPress plugin) that we use both with freescout and helpscout. Its html contains some scripts that we'd like to be executed on freescout. Due to the [freescout restrictions](https://github.com/freescout-help-desk/freescout/wiki/Development-Guide#javascript-and-content-security-policy-csp) that's not possible unless the correct nonce attribute is added to the script elements. So my idea was to replace this line:
https://github.com/fulldecent/freescout-sidebar-webhook/blob/739c02ff29d261a122114d63864d77a0d124f6d9/Public/js/module.js#L15
with this code:
```js
const cspString = $('meta[http-equiv="Content-Security-Policy"]').attr('content');
const nonce = cspString.match(/nonce-([^']+)/)[1];
$('#swh-content').html(response.html.replace(/{{nonce}}/g, `nonce="${nonce}"`));
```
with the webhook server responding with an html like:
```html
[...]
<?php echo file_get_contents($js_file); ?>
[...]
```
what do you think? do you have a better way to do that? And/Or, are you interested into implementing it in your module?
Thank you so much!
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.