# Almost void Discourse object instance will sneak through some safeguards

**URL:** https://meta.discourse.org/t/almost-void-discourse-object-instance-will-sneak-through-some-safeguards/106553
**Category:** Bug
**Created:** [January 15, 2019, 5:17am UTC](https://meta.discourse.org/t/almost-void-discourse-object-instance-will-sneak-through-some-safeguards/106553 "2019-01-15T05:17:50Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![amotl](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/amotl/32/109873_2.png) [@amotl](https://meta.discourse.org/u/amotl)
#### Post date: [January 15, 2019, 5:17am UTC](https://meta.discourse.org/t/almost-void-discourse-object-instance-will-sneak-through-some-safeguards/106553/1 "2019-01-15T05:17:50Z")

</div>

Hi there,

while investigating the root cause of [TypeError: Discourse.\_registerPluginCode is not a function - #2 by amotl](https://meta.discourse.org/t/typeerror-discourse-registerplugincode-is-not-a-function/88572/2), we found that while running through its initialization phase, Discourse introduces itself as a rather void object on all `static` or `no_ember` pages (we learned that jargon while reading here, apologies when we’re getting something wrong) rather than being just `undefined`:

```plaintext
» Discourse
» > Object { SiteSettings: {} }

```

This will make it easy to sneak through safeguards like `"if ('Discourse' in window) {}"` [introduced](https://github.com/discourse/discourse/pull/6098) the other day to protect code from running in restricted environments like static pages or the like, as far as we understood from reading here.

This happens somewhere in between the `</head>` and `Header` stages from the perspective of a theme component, as we could reproduce by running simple Javascript code snippets like

```plaintext
<script> console.log('Discourse-1:', window.Discourse); </script>

```

resp.

```plaintext
<script> console.log('Discourse-2:', window.Discourse); </script>

```

in both scopes, just to observe this outcome in the browser console:  
 ![image](https://global.discourse-cdn.com/meta/original/3X/4/d/4d2639f5b2ccde575f67ef526c8ea25a8682b9ca.png)

Hope this helps.

With kind regards,  
Andreas.