Hi, Any way to run scripts in posts limited only to admins? I have tried setting it up before only to crash my site in PuTTY. Have a good wednesday Olle

There was a post regarding this matter a couple of years ago but I am hopeful if there is a way to do this. https://meta.discourse.org/t/adding-a-javascript-in-a-post/130019/3 Olle

@Olle11 it might help if you go into more detail on what you are trying to achieve. There’s no way to allow this on an ad hoc basis via the Composer, but depending on your use case there might be ways around it. For example, the Poll plugin essentially runs javascript in a Post (amongst other things)

I am hoping to run a script through HTML or React that can show widgets live in the top posts. For example a widget showing the live weather in a city through a HTML widget script. Is the Poll plugin usable for this case? Best regards Olle

No I was just using that as an example. Take a look at its source code. You could try using an iFrame if you can host the JavaScript elsewhere. If you want tight integration you will need to consider using EmberJS.

[image] merefield: You could try using an iFrame if you can host the JavaScript elsewhere. This is probably the most accessible answer if you want content in the post as opposed to, for example, a banner at the top. For example, I picked one of the front page items off CodePen (since it’s in our allowed_iframes) and embedded it below: See the Pen /Hack ＿ - SVG Filter [Editable] by Pedro Ondiviela (@Pedro-Ondiviela) on CodePen. source

It seems like the script I need wont allow iframe due to X-FRAME-Options: DENY.

Perhaps something along these lines to allow a script running in Discourse @merefield @supermathie? App.yml: DISCOURSE_ALLOW_UNSAFE_HTML: true volume: host: /var/discourse/shared/standalone/nginx_custom.conf guest: /etc/nginx/conf.d/custom.conf Nginx configuration for CSP: add_header Content-Security-Policy “script-src ‘self’ ‘https://webadress.com’ ‘unsafe-inline’ ‘unsafe-eval’;”; I am trying to add the Nginx configuration but both ‘unsafe-inline’ and the https will not show up in the CSP when checking with curl. ‘unsafe-eval’ adds through admin. Edit: NOT SAFE

Removing the protections Discourse has in place to prevent this is a terrible idea. That’s why everyone is trying to steer you to the suggested ways of doing this. You should be using a theme or theme component to add scripts to pages.

Can I use a theme or a theme component to add script to a post? How can I include ‘unsafe-inline’ in the CSP to make the script work?

[image] Olle11: Can I use a theme or a theme component to add script to a post? You could. The script itself would need to sit outside of the post, or perhaps you could have it decorate specific aspects of posts. It’s hard to know exactly what you want without specifics. [image] Olle11: How can I include ‘unsafe-inline’ in the CSP to make the script work? This is a bad idea and you should not do it.

Scripts in posts?

Product Support

Olle11 April 11, 2025, 7:14am 17

Thanks for the input. Iframe might work at least for now until i find a better solution.

Topic		Replies	Views
Adding a javascript in a post? Product Support	1	1644	October 2, 2019
Can anyone enable HTML & iFrames within admin posts on my Discourse installation? Marketplace	0	1236	April 14, 2015
Embedding HTML inside posts by Admin Product Support	4	3395	May 12, 2019
JS widget/code (first post) Development	3	829	September 23, 2021
Insert script in a post Development	2	237	May 20, 2024

Scripts in posts?

Related topics