Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Plugin assets, external scripts and CSP overrides #4260

Merged
merged 11 commits into from
Nov 18, 2023

Conversation

WithoutPants
Copy link
Collaborator

This includes a refactoring of the way the /javascript and /css endpoints work. These endpoints are changed to only return the custom javascript/css values provided in the configuration. Plugin-specific scripts and css files are now accessible via /plugin/{pluginID}/javascript and /plugin/{pluginID}/css respectively.

Assets can now be configured in the plugin yml file using the assets field. The assets field maps URL prefixes to paths relative to the directory containing the plugin configuration file. The assets are available at the /plugin/{pluginID}/assets URL path.

For example:

assets:
  foo: bar
  root: .

This will map URLs to these locations:

  • /plugin/foo/assets/foo/file.txt -> {pluginDir}/bar/file.txt
  • /plugin/foo/assets/file.txt -> {pluginDir}/file.txt
  • /plugin/foo/assets/bar/file.txt -> {pluginDir}/bar/file.txt (via the root entry)

CSP policies script-src, style-src and connect-src may now be added to via the csp field:

csp:
  script-src:
    - http://alloweddomain.com
    
  style-src:
    - http://alloweddomain.com
    
  connect-src:
    - http://alloweddomain.com

The css and javascript fields now accept full external URLs. These URLs will be added to csp.script-src automatically. I tested the sceneCoverCropper plugin with the following modification to the yml file:

ui:
  css:
  - https://cdn.jsdelivr.net/npm/cropperjs@1.6.1/dist/cropper.min.css
  javascript:
  - https://cdn.jsdelivr.net/npm/cropperjs@1.6.1/dist/cropper.min.js
  - sceneCoverCropper.js

It still had errors unrelated to this change, but I confirmed that it loaded the css and js file correctly.

@WithoutPants WithoutPants added the feature Pull requests that add a new feature label Nov 1, 2023
@WithoutPants WithoutPants added this to the Version 0.24.0 milestone Nov 1, 2023
@WithoutPants WithoutPants merged commit 222475d into stashapp:develop Nov 18, 2023
2 checks passed
@DogmaDragon DogmaDragon linked an issue May 26, 2024 that may be closed by this pull request
halkeye pushed a commit to halkeye/stash that referenced this pull request Sep 1, 2024
* Add assets for plugins
* Move plugin javascript and css into separate endpoints
* Allow loading external scripts
* Add csp overrides
* Only include enabled plugins
* Move URLMap to utils
* Use URLMap for assets
* Add documentation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature Pull requests that add a new feature
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Feature] UI Plugin dependency loading
1 participant