Key-value pairs representing <script> tag attributes.
Only the attribute name is added to the <script> tag for entries with a boolean value, and that are true.
This has to be used to make WP a CSP compliant system (at least, in the front end. Remains to be tested in the admin area)
functionwpdocs_add_nonce_to_scripts( $attr ){
if ( 'text/javascript' !== $attr['type'] ) {
return $attr;
}
returnarray(
'type' => 'text/javascript',
'nonce' => '123',// Your Nonce. Obviously more featured than this example.
);
}
add_filter( 'wp_inline_script_attributes', 'wpdocs_add_nonce_to_scripts' );
Then, you can use 'nonce-123' in your CSP Policy, example: "script-src 'self' 'noncoe-123';"
Note that this will override other attributes on the script tag. Would be better to set $attr[‘nonce’] on the existing array rather than return a new array.
var wporgFunctionReferenceI18n = {“copy”:”Copy”,”copied”:”Code copied”,”expand”:”Expand code”,”collapse”:”Collapse code”,”sourceFile”:”wp-includes/script-loader.php”};
//# sourceURL=wporg-developer-function-reference-js-extra
var quicktagsL10n = {“closeAllOpenTags”:”Close all open tags”,”closeTags”:”close tags”,”enterURL”:”Enter the URL”,”enterImageURL”:”Enter the URL of the image”,”enterImageDescription”:”Enter a description of the image”,”textdirection”:”text direction”,”toggleTextdirection”:”Toggle Editor Text Direction”,”dfw”:”Distraction-free writing mode”,”strong”:”Bold”,”strongClose”:”Close bold tag”,”em”:”Italic”,”emClose”:”Close italic tag”,”link”:”Insert link”,”blockquote”:”Blockquote”,”blockquoteClose”:”Close blockquote tag”,”del”:”Deleted text (strikethrough)”,”delClose”:”Close deleted text tag”,”ins”:”Inserted text”,”insClose”:”Close inserted text tag”,”image”:”Insert image”,”ul”:”Bulleted list”,”ulClose”:”Close bulleted list tag”,”ol”:”Numbered list”,”olClose”:”Close numbered list tag”,”li”:”List item”,”liClose”:”Close list item tag”,”code”:”Code”,”codeClose”:”Close code tag”,”more”:”Insert Read More tag”};
//# sourceURL=quicktags-js-extra
var wporg_note_preview = {“ajaxurl”:”https://developer.wordpress.org/wp-admin/admin-ajax.php”,”nonce”:”de3c1c9510″,”preview”:”preview note”,”preview_empty”:”Nothing to preview”,”is_admin”:””};
//# sourceURL=wporg-developer-preview-js-extra
Skip to note 2 content
Anonymous User
This has to be used to make WP a CSP compliant system (at least, in the front end. Remains to be tested in the admin area)
function wpdocs_add_nonce_to_scripts( $attr ) { if ( 'text/javascript' !== $attr['type'] ) { return $attr; } return array( 'type' => 'text/javascript', 'nonce' => '123',// Your Nonce. Obviously more featured than this example. ); } add_filter( 'wp_inline_script_attributes', 'wpdocs_add_nonce_to_scripts' );Then, you can use
'nonce-123'in your CSP Policy, example:"script-src 'self' 'noncoe-123';"$attr[‘nonce’]on the existing array rather than return a new array.