woocommerce bug breaking usage guidelines and CSP
-
includes/wc-template-functions.php is printing an inline <script tag (usually a no-no) without calling the correct wordpress function to filter it (wp_print_script_tag), which prevents adding a unique nonce attribute to the script on each request, breaking Content Security Policy.
I’d send a pull request, … but you know. CVS.
The following code on includes/wc-template-functions.php line 355 is incorrect:
function wc_no_js() {
?>
<script type="text/javascript">
(function () { ...
})();
</script>
<?php
}Automattic programming standards, it should be:
function wc_no_js() {
wp_print_script_tag([]);
?>
(function () { ...
})();
</script>
<?php
}Making this change will allow woocommerce users to implement a secure Content Security Policy using existing WordPress standards. Thanks for reading, I hope this change makes it to the repo soon!
- The topic ‘woocommerce bug breaking usage guidelines and CSP’ is closed to new replies.