Johani
(Joe)
Décembre 15, 2019, 5:04
24
Yes, unchecking that setting is not recommended. CSP - content security policy - is on by default for very good reasons. If you need to whitelist some scripts that would normally be flagged by CSP, you can add them to the content_security_policy_script_src
setting on your site and they would then work without issue. You can read
What is Content Security Policy?
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.
– Content Security Policy (CSP) - HTTP | MDN
XSS is still one of the most common web vulnerability – if someone else can run scripts on your site, it is not your site anymore. …
if you want to learn more about this.
2 « J'aime »
smrtey
Décembre 15, 2019, 7:57
25
Doesn’t that setting come unchecked by default?
Johani
(Joe)
Décembre 15, 2019, 8:06
26
No, that setting has been on by default for a while now.
https://github.com/discourse/discourse/pull/6873
3 « J'aime »
smrtey
Décembre 15, 2019, 8:59
27
Weird, our site didn’t even exist in Jan but our default is not checked
Thanks Joe,
I white listed scripts for twitter time line, It works now with CSP option checked.
Is it possible to change background color of twitter time line to match with the forum background ?
1 « J'aime »
smrtey
Décembre 21, 2019, 6:42
31
Not easily because it’s in an iFrame so you can’t just add CSS but there are various suggestions on stackexchange, but not sure which work, for example
html - Styling a Twitter feed - CSS won't target .timeline-Tweet-text - Stack Overflow .
Because of lazy loading (sorry if this isn’t the correct term) on discourse, I think any js solution will require
<script type="text/discourse-plugin" version="0.8">
api.onPageChange(() => {
Do Stuff Here
});
</script>
Hi,
After installing twiiter sidebar to production we are having issues with Dashboard cannot load “Signups” or any individual report it just keeps loading never loads. Discourse version is 2.4.1 recently upgraded. When I remove Twitter side bar component it works fine. Any ideas why this would happen ?
Thanks
Do you have content security policy enabled? I have it working with these settings
I’m running 2.5.0.beta2. No idea what it could have to do with reports but I can generate all the reports on my sites
I have the same settings as you for security policy. When I remove Twitter Sidebar reports start working for some reason.
Sorry, I really have no idea how to go about troubleshooting something involving a conflict with site reports
RGJ
(Richard - Communiteq)
Mars 30, 2020, 7:09
36
The error is TypeError: document.getElementById(…) is null
Apparently the #sidebar
div is not inserted on every page?
It can be fixed by properly checking if the element is not null
.
api.onPageChange(() => {
if (Discourse.User.current() !== null){
var sb = document.getElementById("sidebar")
if (sb) {
sb.style.display = "block";
}
}
});
api.onPageChange(() => {
var is_iPad = navigator.userAgent.match(/iPad/i) != null;
if(is_iPad) {
var sb = document.getElementById("sidebar")
if (sb) {
sb.style.display = "none";
}
}
});
3 « J'aime »
Ali3
(Ali)
Juin 8, 2020, 8:26
37
Is there any one, who can help me to embedd Twitter feed, like they have on the sidebar?
1 « J'aime »
edgarriba
(Edgar Riba)
Février 10, 2021, 11:22
38
I fully support this idea. Has anyone tried with success to get rid of twitter addiction from their community ?
1 « J'aime »