Johani
(Joe)
December 15, 2019, 5:04pm
24
Yes, unchecking that setting is not recommended. CSP - content security policy - is on by default for very good reasons. If you need to whitelist some scripts that would normally be flagged by CSP, you can add them to the content_security_policy_script_src
setting on your site and they would then work without issue. You can read
What is Content Security Policy?
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.
– Content Security Policy (CSP) - HTTP | MDN
XSS is still one of the most common web vulnerability – if someone else can run scripts on your site, it is not your site anymore. …
if you want to learn more about this.
2 Likes
smrtey
December 15, 2019, 7:57pm
25
Doesn’t that setting come unchecked by default?
Johani
(Joe)
December 15, 2019, 8:06pm
26
No, that setting has been on by default for a while now.
https://github.com/discourse/discourse/pull/6873
3 Likes
smrtey
December 15, 2019, 8:59pm
27
Weird, our site didn’t even exist in Jan but our default is not checked
Thanks Joe,
I white listed scripts for twitter time line, It works now with CSP option checked.
Is it possible to change background color of twitter time line to match with the forum background ?
1 Like
smrtey
December 21, 2019, 6:42pm
31
Not easily because it’s in an iFrame so you can’t just add CSS but there are various suggestions on stackexchange, but not sure which work, for example
html - Styling a Twitter feed - CSS won't target .timeline-Tweet-text - Stack Overflow .
Because of lazy loading (sorry if this isn’t the correct term) on discourse, I think any js solution will require
<script type="text/discourse-plugin" version="0.8">
api.onPageChange(() => {
Do Stuff Here
});
</script>
Hi,
After installing twiiter sidebar to production we are having issues with Dashboard cannot load “Signups” or any individual report it just keeps loading never loads. Discourse version is 2.4.1 recently upgraded. When I remove Twitter side bar component it works fine. Any ideas why this would happen ?
Thanks
smrtey
March 27, 2020, 5:21pm
33
Do you have content security policy enabled? I have it working with these settings
I’m running 2.5.0.beta2. No idea what it could have to do with reports but I can generate all the reports on my sites
I have the same settings as you for security policy. When I remove Twitter Sidebar reports start working for some reason.
smrtey
March 27, 2020, 6:50pm
35
Sorry, I really have no idea how to go about troubleshooting something involving a conflict with site reports
RGJ
(Richard - Communiteq)
March 30, 2020, 7:09pm
36
The error is TypeError: document.getElementById(…) is null
Apparently the #sidebar
div is not inserted on every page?
It can be fixed by properly checking if the element is not null
.
api.onPageChange(() => {
if (Discourse.User.current() !== null){
var sb = document.getElementById("sidebar")
if (sb) {
sb.style.display = "block";
}
}
});
api.onPageChange(() => {
var is_iPad = navigator.userAgent.match(/iPad/i) != null;
if(is_iPad) {
var sb = document.getElementById("sidebar")
if (sb) {
sb.style.display = "none";
}
}
});
3 Likes
Ali3
(Ali)
June 8, 2020, 8:26pm
37
Is there any one, who can help me to embedd Twitter feed, like they have on the sidebar?
1 Like
edgarriba
(Edgar Riba)
February 10, 2021, 11:22pm
38
I fully support this idea. Has anyone tried with success to get rid of twitter addiction from their community ?
1 Like