Scripts in posts?

[Olle11]

Hi,

Any way to run scripts in posts limited only to admins?

I have tried setting it up before only to crash my site in PuTTY.

Have a good wednesday
Olle

[Olle11]

There was a post regarding this matter a couple of years ago but I am hopeful if there is a way to do this.

https://meta.discourse.org/t/adding-a-javascript-in-a-post/130019/3

Olle

[merefield (Robert)]

@Olle11 it might help if you go into more detail on what you are trying to achieve.

There’s no way to allow this on an ad hoc basis via the Composer, but depending on your use case there might be ways around it.

For example, the Poll plugin essentially runs javascript in a Post (amongst other things)

[Olle11]

I am hoping to run a script through HTML or React that can show widgets live in the top posts.

For example a widget showing the live weather in a city through a HTML widget script.

Is the Poll plugin usable for this case?

Best regards
Olle

[merefield (Robert)]

No I was just using that as an example. Take a look at its source code.

You could try using an iFrame if you can host the JavaScript elsewhere.

If you want tight integration you will need to consider using EmberJS.

[supermathie (Michael Brown)]

@merefield

You could try using an iFrame if you can host the JavaScript elsewhere.

This is probably the most accessible answer if you want content in the post as opposed to, for example, a banner at the top.

For example, I picked one of the front page items off CodePen (since it’s in our allowed_iframes) and embedded it below:

source

[Olle11]

It seems like the script I need wont allow iframe due to X-FRAME-Options: DENY.

[Olle11]

Perhaps something along these lines to allow a script running in Discourse @merefield @supermathie?

App.yml:
DISCOURSE_ALLOW_UNSAFE_HTML: true

• volume:
  host: /var/discourse/shared/standalone/nginx_custom.conf
  guest: /etc/nginx/conf.d/custom.conf

Nginx configuration for CSP:
add_header Content-Security-Policy “script-src ‘self’ ‘https://webadress.com’ ‘unsafe-inline’ ‘unsafe-eval’;”;

I am trying to add the Nginx configuration but both ‘unsafe-inline’ and the https will not show up in the CSP when checking with curl. ‘unsafe-eval’ adds through admin.

Edit: NOT SAFE

[supermathie (Michael Brown)]

Removing the protections Discourse has in place to prevent this is a terrible idea.

That’s why everyone is trying to steer you to the suggested ways of doing this.

You should be using a theme or theme component to add scripts to pages.

[Olle11]

Can I use a theme or a theme component to add script to a post?

How can I include ‘unsafe-inline’ in the CSP to make the script work?

[supermathie (Michael Brown)]

@Olle11

Can I use a theme or a theme component to add script to a post?

You could. The script itself would need to sit outside of the post, or perhaps you could have it decorate specific aspects of posts.

It’s hard to know exactly what you want without specifics.

@Olle11

How can I include ‘unsafe-inline’ in the CSP to make the script work?

This is a bad idea and you should not do it.

[Olle11]

Regarding the CSP and what I added to app.yml I will remove the unsafe_html: true, the nginx volume and the nginx configuration for CSP from the site because it is not safe.

Maybe a theme component works hmm

[pfaffman (Jay Pfaffman)]

Exactly what script do you want to run?

Where do you want to run it?

Is it to be on a particular post? Or somewhere else in the page? What parameters need to be passed? Is it different in every post? Category?

[Olle11]

Iframe might work. I do need to update the CSP and unsafe_html so the website is safe because CSP and the other solutions i tried are not safe

[Olle11]

Thanks for the input. Iframe might work at least for now until i find a better solution.

[Arkshine]

Looking at the script, you can’t run it globally. It requires loading on place with options.

I made a simple TC: GitHub - Arkshine/discourse-tradingview-chart

To make it easy to change the options, you can copy and paste them from the site directly inside the [wrap]..[/wrap].

By default, it forces the aspect-ratio to be 16/9, it will take all the width space, and the height is automatic. The script allows specifying a width/height, it will work as well.

I would suggest using show_popup_button: true option. It will provide you with a way to view the chart in fullscreen in a new window.

I added two options:

[pfaffman (Jay Pfaffman)]

Sorry, but just a isn’t enough to convey . . .

Dude. That’s awesome.