2

We recently created a new "Build Your Own" template community in our sandbox and we were adding our script snippets in the builder for our analytics tool (click the settings cog -> advanced -> edit header markup)

It seems to be adding the communities URL into the url from the script tag which is new behavior.

the format of the script tag is (removed the information to identify the script) in the edit header markup section:

<script src=“//subdomain.domain.com/*/*/script.min.js” async></script>

On our production environment, if you view source of the community, it displays this link as it is and you can click and navigate to the actual script file url

Our production community was created when you could use this setting (no longer available): picture of older community setting where this is working properly

In our Sandbox, with the same format for the edit header markup section, it's adding the full communities url to that script tag src= when you view source of the page.

I added this script url to "Content Security Policy Trusted Sites" in setup and in the communities builder "Trusted Sites for Scripts".

Any suggestions on how to get this url to load properly from the header markup?

I did try adding https: to the script src and removing async.

Improve this question
4
  • Is the script file hosted outside of Salesforce? The CSP header script-src is restricted as per help.salesforce.com/…
    – akiradev
    Mar 10, 2020 at 14:42
  • Based on that document, I've added connect-src= to my script tag and it's not giving a console error. This may have fixed it. I'll let you know shortly if it works.
    – Bob Burdekin
    Mar 10, 2020 at 16:09
  • I read that too quickly. "Allow Lightning components to load URLs using script interfaces from this site." That won't work for this. Is there anyway to get outside of this script src block? Our communities created before the last salesforce release don't seem to have this issue.
    – Bob Burdekin
    Mar 10, 2020 at 17:13
  • It really depends how the js file is hosted. Third-party js files need to be stored statically in static resources - CDN or remotely hosted scripts are not be allowed.
    – akiradev
    Mar 10, 2020 at 17:23

1 Answer 1

Reset to default
0 
<script src=“//subdomain.domain.com/*/*/script.min.js” async></script>

Make sure those quotes are properly encoded. Using the wrong type of quote can cause major issues.

<script src="//subdomain.domain.com/*/*/script.min.js" async></script>

We just had a related issue, and it turned out to be that easy.

Improve this answer
1
  • I copied an pasted that snippet from slack. LOL! Classic copy and paste lesson. Thank you sir.
    – Bob Burdekin
    Mar 10, 2020 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .