Scripts in posts?

Product Support
9

Perhaps something along these lines to allow a script running in Discourse @merefield @supermathie?

App.yml:
DISCOURSE_ALLOW_UNSAFE_HTML: true

  • volume:
    host: /var/discourse/shared/standalone/nginx_custom.conf
    guest: /etc/nginx/conf.d/custom.conf

Nginx configuration for CSP:
add_header Content-Security-Policy “script-src ‘self’ ‘https://webadress.com’ ‘unsafe-inline’ ‘unsafe-eval’;”;

I am trying to add the Nginx configuration but both ‘unsafe-inline’ and the https will not show up in the CSP when checking with curl. ‘unsafe-eval’ adds through admin.

Edit: NOT SAFE