-
Notifications
You must be signed in to change notification settings - Fork 841
Update Jetpack_Notifications::print_js() to be CSP-compatible
#45878
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
Thank you for your PR! When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:
This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖 Jetpack plugin: The Jetpack plugin has different release cadences depending on the platform:
If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack. |
|
Thanks @westonruter, this looks great. I'd like to push a change to simplify the script, it doesn't seem like there's a reason to use an output buffer and wrap in I'll update this comment as I perform testing. Before (linked): <script data-ampdevmode type="text/javascript">
/* <![CDATA[ */
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
/* ]]> */
</script>Before (unlinked): <script data-ampdevmode type="text/javascript">
/* <![CDATA[ */
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
var wpNotesLinkAccountsURL = 'https://example.com/wp-admin/admin.php?page=jetpack';
/* ]]> */
</script>After (linked): <script data-ampdevmode>
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
</script>After (unlinked): <script data-ampdevmode>
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
var wpNotesLinkAccountsURL = "https://example.com/wp-admin/admin.php?page=jetpack";
</script>With no output buffer Linked: <script data-ampdevmode>
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
</script>Unlinked: <script data-ampdevmode>
var wpNotesIsJetpackClient = true;
var wpNotesIsJetpackClientV2 = true;
var wpNotesLinkAccountsURL = "https://example.com/wp-admin/admin.php?page=jetpack";
</script> |
sirreal
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you! I've left a more detailed testing report here: #45878 (comment)
@westonruter if you're happy with the additional adjustments I've made, this seems ready to merge.
|
I've also followed these steps and the notifications bell works. A nonce attribute is added to the relevant script tag:
|
Co-authored-by: tbradsha <32492176+tbradsha@users.noreply.github.com>
@sirreal Thanks. Not a big deal, but the reason for this is is to have syntax highlighting in the IDE. This is previously discussed in Core-58664 with a follow-up in Core-59444. It's the reason for why
Versus the latest changes:
Granted, the nowdoc you're using achieves much of the same effect at least in the first part of the JS, which is also discussed in Core-59444, albeit with the annoying thing you can't indent the final delimiter until we can bump PHP to 7.3. Anyway, I don't feel strongly about this. It's a trivial amount of JS in any case, so the syntax highlighting is not really needed anyway. Thanks for following up! |


Proposed changes:
To be compatible with CSP, the
nonceattribute needs to be able to be inserted intoSCRIPTtags generated by WordPress. This is made possible when usingwp_print_script_tag()andwp_print_inline_script_tag().This has been slowly rolling out to WordPress core. For context, see these Trac tickets:
This also improves the exporting of data from PHP to JS per https://sirre.al/2025/08/06/safe-json-in-script-tags-how-not-to-break-a-site/
Other information:
Jetpack product discussion
Does this pull request change what data or activity we track or use?
Testing instructions: