# 2.5.0.beta5 breaks retort plugin

**URL:** https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378
**Category:** Support
**Created:** [May 31, 2020, 9:25am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378 "2020-05-31T09:25:11Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![Boost](https://avatars.discourse-cdn.com/v4/letter/b/8e8cbc/32.png) [@Boost](https://meta.discourse.org/u/Boost)
#### Post date: [May 31, 2020, 9:25am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/1 "2020-05-31T09:25:11Z")

</div>

I just updated from 2.5.0.beta4 to 2.5.0.beta5 and now my two scripts that I have in my theme no longer seem to run, and I see this in my browser console:

```plaintext
Content Security Policy: Sivuston asetukset estivät resurssin lataamisen osoitteesta inline ("script-src"). injectGlobalHook.js:1:1760
Content Security Policy: Sivuston asetukset estivät resurssin lataamisen osoitteesta inline ("script-src"). pagewrap.bundle.js:1:1151

```

Edit: it seems I get these on my other site as well that I don’t have the same theme on, so this isn’t the problem. So I guess the theme API changed? Even though this topic has not been updated: [Using the JS API](https://meta.discourse.org/t/using-the-pluginapi-in-site-customizations/41281)

Basically it seems that the new discourse update made the CSP more strict.  
How would I go about fixing this? I didn’t find anything regarding CSP or theme changes in the release notes.

This is my script I want to run:

```plaintext
<script type="text/discourse-plugin" version="0.0.1">
api.onPageChange(() => {
	checkMainPageLoadFeeds();
});

function checkMainPageLoadFeeds() {
    // Only load on main page
    // Apparently this doesn't work perfectly due to the way discourse works, 
    // but at least this doesn't cause any issues either...
    if(/https?:\/\/[^\/]+\/(categories)?$/.test(window.location.href) ){
        // These files are created by a bot running on the same server as this forum
        if($("#development-info").text() == ""){
            $("#development-info").load("/thrive-feed-bot/devforum-and-github");
            $("#announcement-contents").load("/thrive-feed-bot/community-announcements");
        }
    }
    
    $("#development-heading").off("click").on("click", expandTheFeeds);
    $("#announcement-heading").off("click").on("click", expandTheFeeds);
}

function expandTheFeeds(){
    
    let target = $("#development-feed").height() == 200 ? 450 : 200;
    $('#development-feed').animate({ height: target + "px" });
    $('#development-info').animate({ height: (target - 95) + "px" });
    $('#announcement-feed').animate({ height: target + "px" });
    $('#announcement-contents').animate({ height: (target - 95) + "px" });
}

$( document ).ready(function(){
    checkMainPageLoadFeeds();
})
</script>

```

And this is the second one:

```plaintext
<script type="text/discourse-plugin" version="0.0.1">
api.onAppEvent('modal:body-shown', (data) => {
    
    if(data.title){
    
        if(data.title.match(/.*create.*account.*/)){
        
            $(".create-account.fixed-modal .modal-footer").prepend(getEmailSpamCheckMessage(true));
        }
    } else {
        
        // Might be forgot password
        let element = $(".fixed-modal .forgot-password-modal")
        if(element){
            element.append(getEmailSpamCheckMessage(false));
        }
    }
	
});

function getEmailSpamCheckMessage(register){
    return $.parseHTML("<p class='EmailNoteMessage'>If you don't receive an email " + 
                (register ? "confirmation " : "") + "check your spam folder.<br>" +
                "You can also visit our <a href='https://discordapp.com/invite/FZxDQ4H'>discord</a> " +
                "if you have trouble " + (register ? "registering" : "receiving emails from us") + ".</p>");
}
</script>

```

Which I’m sure I have posted here on meta before but can’t find that post now.

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 31, 2020, 9:53am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/2 "2020-05-31T09:53:48Z")

</div>

All you want to know about CSP is here:

> [@Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243):
>
> bookmark This guide explains how to use Content Security Policy (CSP) to mitigate Cross-Site Scripting (XSS) attacks in Discourse. It covers CSP basics, configuration, and best practices. person_raising_hand Required user level: Administrator Summary Content Security Policy (CSP) is a crucial security feature in Discourse that helps protect against Cross-Site Scripting (XSS) and other injection attacks. This guide covers the basics of CSP, how it’s implemented in Discourse, and how to c…

---

<div class="post-metadata">

### Author: ![Boost](https://avatars.discourse-cdn.com/v4/letter/b/8e8cbc/32.png) [@Boost](https://meta.discourse.org/u/Boost)
#### Post date: [May 31, 2020, 9:58am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/3 "2020-05-31T09:58:58Z")

</div>

I don’t think my problem is with CSP, as I get the same 2 errors on a site ([https://forum.revolutionarygamesstudio.com/](https://forum.revolutionarygamesstudio.com/)) which uses the default theme. So it seems that my scripts aren’t even attempted to be loaded. On the site with a custom theme the boxes near the top of the page stay blank as javascript is used to fill them: [https://community.revolutionarygamesstudio.com/](https://community.revolutionarygamesstudio.com/)  
I also tried toggling CSP off in the admin section, but that didn’t seem to fix my scripts, but did make the 2 errors go away (leaving only one coming from retort).

Edit: So I’m thinking that something changed which makes it so that `<script type="text/discourse-plugin" version="0.0.1">` don’t load at all anymore

Edit 2: So even with CSP enabled and nothing added to whitelist, this works:

```plaintext
<script>
console.log('this loaded just fine');
</script> 

```

But this doesn’t:

```plaintext
<script type="text/discourse-plugin" version="0.0.1">
console.log('this loaded just fine');
</script> 

```

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 31, 2020, 10:05am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/4 "2020-05-31T10:05:50Z")

</div>

You have a js error with retort on [https://community.revolutionarygamesstudio.com/](https://community.revolutionarygamesstudio.com/)

```
_retort-75a57ba39180becb082af07c57df6a5dd4e16efe0dbd24ec6c4e5d903e138efb.js:188 Uncaught TypeError: Cannot read property 'retort_disabled_categories' of undefined
    at _retort-75a57ba39180becb082af07c57df6a5dd4e16efe0dbd24ec6c4e5d903e138efb.js:188
    at t.module.exports.u.<computed> (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74640)
    at t.module.exports.u.<computed> (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74470)
    at require (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74637)
    at f (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74596)
    at _ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74561
    at t.module.exports.u.<computed> (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74639)
    at t.module.exports.u.<computed> (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74470)
    at require (_ember_jquery-1ed3f3559e6f967733b4088aa729ff7039dff2c09c5a5f787a214b016f58aabc.js:74637)
    at t._prepareInitializer (_application-66bcc4126a5a02dd0d99aed67150087a79a427788cc00feaf5e17bf042b73d75.js:6849)

```

Concerning the other site, I can’t find `checkMainPageLoadFeeds` in the source code so not sure this is loaded.

Can find it on [https://community.revolutionarygamesstudio.com/](https://community.revolutionarygamesstudio.com/) though:

 ![Screenshot 2020-05-31 at 12.06.56](https://global.discourse-cdn.com/meta/original/3X/2/b/2b580a5cbb4b2f6325fbb91d255578fc7d30edc3.png)

So try to fix your js error with this plugin.

---

<div class="post-metadata">

### Author: ![Boost](https://avatars.discourse-cdn.com/v4/letter/b/8e8cbc/32.png) [@Boost](https://meta.discourse.org/u/Boost)
#### Post date: [May 31, 2020, 10:09am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/5 "2020-05-31T10:09:02Z")

</div>

> [@j.jaffeux](#):
>
> Concerning the other site, I can’t find `checkMainPageLoadFeeds` in the source code so not sure this is loaded.

That’s what I’m seeing. See my update in the previous post, it seems that the script type `"text/discourse-plugin"` doesn’t run, but a plain script tag does.

> [@j.jaffeux](#):
>
> You have a js error with retort on [https://community.revolutionarygamesstudio.com/](https://community.revolutionarygamesstudio.com/)

I noticed that, I have the latest retort version:  
 ![Kuvakaappaus - 2020-05-31 13-07-36](https://global.discourse-cdn.com/meta/optimized/3X/d/a/da54dd4ba2474d795e598dcd0e0b7dd037ac87e8_2_690x48.png)

> [@j.jaffeux](#):
>
> So try to fix your js error with this plugin.

So that plugin having an error is stopping the plugin defined in the theme from running?

---

<div class="post-metadata">

### Author: ![j.jaffeux](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/j.jaffeux/32/60297_2.png) [@j.jaffeux](https://meta.discourse.org/u/j.jaffeux)
#### Post date: [May 31, 2020, 10:13am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/6 "2020-05-31T10:13:33Z")

</div>

> [@Boost](#):
>
> That’s what I’m seeing. See my update in the previous post, it seems that the script type `"text/discourse-plugin"` doesn’t run, but a plain script tag does.

I just tested here on meta and this is correctly called:

```javascript
<script type="text/discourse-plugin" version="0.1">
</script>

```

> [@Boost](#):
>
> I noticed that, I have the latest retort version:

This is not an official plugin, don’t know much about it sorry.

> [@Boost](#):
>
> So that plugin having an error is stopping the plugin defined in the theme from running?

It’s possible yes, try to deactivate or even remove it and see if it fixes your issue.

---

<div class="post-metadata">

### Author: ![Boost](https://avatars.discourse-cdn.com/v4/letter/b/8e8cbc/32.png) [@Boost](https://meta.discourse.org/u/Boost)
#### Post date: [May 31, 2020, 10:39am UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/7 "2020-05-31T10:39:43Z")

</div>

Rebuilding without retort in my list of plugins, “fixes” the issue. Thanks for the help. I didn’t consider that one plugin failing could make any other plugin to fail as well. I’ll try to remember this in the future to check before reporting an issue.

I’ll mark this as the solution, while waiting for a new version of retort so that I can enable it again.

Looks like issues with the latest discourse have already been reported:

> [@Discourse Retort](https://meta.discourse.org/t/retort-a-reaction-style-plugin-for-discourse/35903/341):
>
> @gdpelican New issue found with retort plugin, please look into this… slightly_frowning_face[https://github.com/gdpelican/retort/issues/65](https://github.com/gdpelican/retort/issues/65)

---

<div class="post-metadata">

### Author: ![mcdanlj](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mcdanlj/32/131829_2.png) [@mcdanlj](https://meta.discourse.org/u/mcdanlj)
#### Post date: [June 1, 2020, 3:40pm UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/8 "2020-06-01T15:40:56Z")

</div>

I confirm the fix to retort has resolved this issue for me.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [July 1, 2020, 3:42pm UTC](https://meta.discourse.org/t/2-5-0-beta5-breaks-retort-plugin/153378/9 "2020-07-01T15:42:15Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.