fulldecent / fulldecent/freescout-sidebar-webhook

Easy way to allow scripts execution?

Open
#14 4 comments 1 reaction 0 assignees View on GitHub
help wanted
Dominant language
PHP
Stars
35
Forks
16
PR merge metrics
No merged PRs in 30d

Description

Hi there,
in my company we have a widget (provided by a WordPress plugin) that we use both with freescout and helpscout. Its html contains some scripts that we'd like to be executed on freescout. Due to the [freescout restrictions](https://github.com/freescout-help-desk/freescout/wiki/Development-Guide#javascript-and-content-security-policy-csp) that's not possible unless the correct nonce attribute is added to the script elements. So my idea was to replace this line:

https://github.com/fulldecent/freescout-sidebar-webhook/blob/739c02ff29d261a122114d63864d77a0d124f6d9/Public/js/module.js#L15

with this code:

```js
const cspString = $('meta[http-equiv="Content-Security-Policy"]').attr('content');
const nonce = cspString.match(/nonce-([^']+)/)[1];

$('#swh-content').html(response.html.replace(/{{nonce}}/g, `nonce="${nonce}"`));
```

with the webhook server responding with an html like:
```html
[...]

<?php echo file_get_contents($js_file); ?>

[...]
```

what do you think? do you have a better way to do that? And/Or, are you interested into implementing it in your module?

Thank you so much!

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.