0

We are able to successfully pull in components for header and footer using CMS connect, however it appears that Sales Force is not pulling in the JS scripts referenced in the header and footer which make the menus function.

Any ideas or thoughts from those who have successfully got CMS connect to pull in JS script for menus and etc.

Or is this a known bug in CMS connect? We are finding, even if the js script is a verified mime type coming from an Apache serve, it does not load.

Everything works fine, except for the JS scripts that control the menus

Please advise on any proven success where you were able to get CMS Connect to pull in JS script successfully?

Thanks

Improve this question
  • Note: We get the following error when js script tries to load: JsLoader: Got error [object Object] while downloading script myanynamesite.com/header/js/app.min.js (anonymous) @ siteforce:CMSLibrary.js:24 – user1970864 Aug 3 '18 at 19:47
  • So, is anyone using CMS Connect? Or have issues pulling in JS scripts in the header or footer? – user1970864 Aug 6 '18 at 16:56
  • 3rd attempt in a month to get CMS Connect to work or seek assistance. Is anyone using CMS Connect? Or have issues with getting JS Angular scripts and CSS from external CMS connect source to load? – user1970864 Sep 10 '18 at 15:22
0

External resources must be whitelisted, but scripts are handled differently than other resources. JS uses the following process:

Script resources, such as JavaScript, must be whitelisted in the Security settings of Builder.

whereas other resources require the following process:

Non-script resources, such as images and css, must be whitelisted in CSP Trusted Sites in your Salesforce org settings

In addition, security controls may need to be modified based on the third party code:

Note: In Winter '19, the Enable Stricter Content Security Policy for Lightning Components in Communities critical update was replaced with new CSP options in Settings > Security in Community Builder. There are three levels of script security, providing enough flexibility to prevent affecting existing communities and code.

Strict CSP tightens CSP to mitigate the risk of cross-site scripting attacks by disallowing the unsafe-inline and unsafe-eval keywords for inline scripts (script-src). Ensure that your code and the third-party libraries that you use adhere to these rules by removing all calls using eval() or inline JavaScript code execution. You might have to update your third-party libraries to modern versions that don’t depend on unsafe-inline or unsafe-eval.

Communities allow unsafe-inline and unsafe-eval, when not using strict CSP, to support common services such as Google Tag Manager.

References

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.