react-script-editor affected by SPO changes to custom scripts?

[mschrade]

@wobba is there any reason to believe this will be affected by "MC714186 - Remove Custom Script setting in OneDrive and SharePoint web"? Love using this and hope to continue doing so!

From the MSFT communication: In the SharePoint admin center, there is a Custom Script setting that controls whether users can run custom scripts in OneDrive and SharePoint sites. This setting will be removed in March 2024.

For now, looks like only change is in GUI, but wondering about it long-term.

[wobba]

That depends if you built it from the existing code or modified it to bypass the "custom script" setting. Also read the MC post carefully as it explains all you need to do to keep "NoScript" working for as long as you need.

And this is a good change, as you should never allow custom scripting anywhere due to the potential security threat this brings.

[prasannabj]

@wobba / @mschrade : May I check, would you confirm that without setting the DenyAddAndCustomizePages property false through PowerShell and also the "requiresCustomScript": false in ScriptEditorWebPart.manifest.json file, react-script-editor webpart does not show in Modern sites?

PowerShell Changes:
Connect-SPOService -URL $AdminSiteURL -Credential $Cred
Set-SPOSite $SiteURL -DenyAddAndCustomizePages $False

Solution Changes:
ScriptEditorWebPart.manifest.json file with the following change:

"requiresCustomScript": false

Our Team does not have tenant admin rights, we have only Site Collection Admin access.

[wobba]

Correct, the web part if built to honor what it actually does - which is injecting script, will not show on a site unless you set the DenyAddAndCustomizePages property every day. Which is a good thing. The proper solution is to replace the script editor web part with a SPFx webpart including the code inside of it so it cannot be changed by someone with edit access.