xss - WordPress + Disqus + refused executing inline script -
i've loaded disquss on wordpress website, running on https. problem while comments shown @ bottom of webpage, white (and since background of page white, not visible).
if open inspector in chrome, following error printed console tab.
refused execute inline script because violates following content security policy directive: "script-src https://*.twitter.com:* https://api.adsnative.com/v1/ad.json *.adsafeprotected.com *.google-analytics.com https://glitter-services.disqus.com https://*.services.disqus.com:* disqus.com http://*.twitter.com:* a.disquscdn.com api.taboola.com referrer.disqus.com *.scorecardresearch.com *.moatads.com https://admin.appnext.com/offerwallapi.aspx 'unsafe-eval' https://mobile.adnxs.com/mob *.services.disqus.com:*". either 'unsafe- inline' keyword, hash ('sha256-...'), or nonce ('nonce-...') required enable inline execution.
this happens because of popup blocker extension in chrome, enable content security policy: http://www.html5rocks.com/en/tutorials/security/content-security-policy/ . basically, error occurs in chrome-extension://* scheme, need add appropriate entry content-security-policy allow chrome extensions.
how should disable security policy chrome extensions?
how should disable security policy chrome extensions?
not. additionally can not.
i need add appropriate entry content-security-policy allow chrome extensions.
the csp of extensions part of (local) extension.
while comments shown @ bottom of webpage, white sounds matter of css me ...
color: black;
text?
or short: websites not able mess extensions. - don't want facebook disable csp , send personal porn preferences (from pornliner addon) profile.
Comments
Post a Comment