Conversation
supportHello, I noticed that the tick icon for the checkboxes is being loaded from some external source data:image/svg+xml;utf8,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20viewBox%3D%270%200%2020%2020%27%3E%3Cpath%20d%3D%27M14.83%204.89l1.34.94-5.81%208.38H9.02L5.78%209.67l1.34-1.25%202.57%202.4z%27%20fill%3D%27%233582c4%27%2F%3E%3C%2Fsvg%3E Because of our Content-Security-Policy it wouldn’t load, so it’s pretty much impossible to see if the box is checked or not. Whitelisting w3.org also won’t help. I would appreciate if the plugin would not load such simple things from an external website.
Are you sure you are submitting this ticket for the correct plugin? This code does not exist anywhere in No Nonsense. No Nonsense does not use any tick icon images. Wherever this code is from though, what I see in this sample code you pasted in is encoded SVG/XML data. It’s not loading anything from w3.org; that’s just the value inside the xmlns (XML namespace) attribute of the <svg> tag. The entirety of the image would be right there in that code, not loading any extra assets at all.
That’s what the browsers console shows me when e.g. I want to tick the “also kill any incoming XML-RPC request” checkbox. Read: the message that this specific element has been refused to load because of content security politicy appears in the console the exact moment when I click there checkbox and will be displayed every time I reload the site until I uncheck the box. So this error message can only be triggered by this plugin
I did a bit more checking, and that code is in WordPress core. It does appear that WordPress uses it to generate custom-designed checkboxes for the admin pages, so it’s probably getting loaded on the No Nonsense page as a result. But as this is a standard part of the WordPress platform itself, it’s not something I have any control over.
I see. Interesting, thanks
this seems to be a very common problem for a few weeks now. The solution is to add data: to the whitelist of the image-src content security policy
Thanks for the follow up! This would be useful to share in a more general way (or should I say “place”) for any WordPress users who are managing a content security policy. I’m not quite sure where that would be, but perhaps here .
Are you sure you are submitting this ticket for the correct plugin? This code does not exist anywhere in No Nonsense. No Nonsense does not use any tick icon images. Wherever this code is from though, what I see in this sample code you pasted in is encoded SVG/XML data. It’s not loading anything from w3.org; that’s just the value inside the xmlns (XML namespace) attribute of the <svg> tag. The entirety of the image would be right there in that code, not loading any extra assets at all.
That’s what the browsers console shows me when e.g. I want to tick the “also kill any incoming XML-RPC request” checkbox. Read: the message that this specific element has been refused to load because of content security politicy appears in the console the exact moment when I click there checkbox and will be displayed every time I reload the site until I uncheck the box. So this error message can only be triggered by this plugin
I did a bit more checking, and that code is in WordPress core. It does appear that WordPress uses it to generate custom-designed checkboxes for the admin pages, so it’s probably getting loaded on the No Nonsense page as a result. But as this is a standard part of the WordPress platform itself, it’s not something I have any control over.
I see. Interesting, thanks
this seems to be a very common problem for a few weeks now. The solution is to add data: to the whitelist of the image-src content security policy
Thanks for the follow up! This would be useful to share in a more general way (or should I say “place”) for any WordPress users who are managing a content security policy. I’m not quite sure where that would be, but perhaps here .