In the EPN Smart Links support thread, agentpoyo reports that inline JavaScript required for eBay affiliate links (via EPN) is being stripped from the theme’s header, even though CSP is disabled on their test instance. The critical line <script>window._epn = {campaign:XXXXXXXXXX};</script> disappears upon saving, preventing affiliate link conversion. Falco suggests extracting the script into a theme JavaScript file, as Discourse blocks inline JS by default—even with CSP disabled—for security. agentpoyo asks for clarification on implementation, noting they’re not a developer and are using the default Light theme. Falco confirms Discourse enforces JS file usage regardless of CSP settings. agentpoyo questions why inline scripts are still blocked if CSP is off, to which Falco explains that Discourse’s default architecture avoids inline JS entirely. devzero adds that similar issues affect AdSense integration, citing other threads where users struggle with inline script restrictions. The consensus is that inline JS must be moved to external theme JS files, even if CSP is disabled, and users are advised to create a custom JS file (e.g., epn_links.js) and load it via <script src="epn_links.js"></script> in the theme’s header. This workaround applies broadly to any third-party scripts requiring inline execution in Discourse.
Seems when I attempt to add Smart Links that turn eBay links into rover .ebay. com affiliate links, it’s stripping out the script code with the campaign id that is essential to building the link.
If I comment the tag out with it shows up in the source code.
Am I missing something? This code works fine on Wordpress and other sites. What would cause this to get stripped which I believe is the cause in ebay links not turning into affiliate rover ebay com links.
That line should be extracted into a theme file, since inline Javascript is not allowed in recent versions of Discourse (for CSP). Did you check all theme JavaScript files too?
That might be it then if I need to add that line to the theme. I take it I’ll have to add outside of the theme customization administration into the themed files? Where would I do that exactly, within the container itself on the flat files or code? Right now I’m just testing with the default Light theme. Thanks.
After reading your reply again, this doesn’t make sense if I’ve disabled CSP entirely. So by disabling CSP and it’s still blocking inline scripts, that tells me it’s not entirely disabling CSP. Or am I missing something?
Okay, that makes sense but doesn’t make sense if one disables CSP but yet it’s still enabled from what you’ve told me.
So do I need to create a new public/javascripts file with this bit of the code and have it load from there as something like:
<script src="epn_links.js"></script>
You’ll have to excuse my newbiness. I’m not a developer, just trying to setup a Discourse site that enables EPN links so any ebay links turn into affiliated links.