Skip to content

FacetWP does not allow for addNonceForDirective #2

@robertbossaert

Description

@robertbossaert

Due to FacetWP registering their script like this in class-display.php (line 230 to 232):

$html = $is_css ? '<link href="{url}" rel="stylesheet">' : '<script src="{url}"></script>';
$html = apply_filters( 'facetwp_asset_html', $html, $url );
echo str_replace( '{url}', $url, $html ) . "\n";

It's impossible to apply:

$this->addNonceForDirective(Directive::SCRIPT);

We could probably unset and re-register the scripts there, but still it's unfortunate it's not using the wp_enqueue style and scripts because then a function such as https://developer.wordpress.org/reference/hooks/wp_script_attributes/ would have control over it.

There is a bigger problem for the <script> tags containing window.FWP_JSON and window.FWP_HTTP (line 239 to 242) which would have been nice if it used the wp_localize_script, that one seems more difficult to filter? since it contains logic.

It would already be a huge improvement if they used: wp_print_script_tag or wp_print_inline_script.

I have had contact with them about this but they are not going to change the way they register the script tags, so this issue is blocked until (if ever) they do.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions