Inline scripts should be avoided

[michael-e]

The extension driver adds an inline script to the head of the page:

// add pagination and filter data into symphony context if Symphony does not provide it
Administration::instance()->Page->addElementToHead(
	new XMLElement(
		'script', 
		'if (! Symphony.Context.get(\'env\').pagination) Symphony.Context.get(\'env\').pagination='.json_encode($pagination).';' .
		'if (! Symphony.Context.get(\'env\').filters) Symphony.Context.get(\'env\').filters='.json_encode($generatedFilters).';'
		, array(
			'type' => 'text/javascript'
		)
	)
);

This should be avoided. If you use Content Security Policy HTTP headers, you will always attempt to limit the allowed script sources as much as possible, avoiding inline scripts at all costs. (Security evaluation websites like https://observatory.mozilla.org will blame you for allowing inline scripts because this enables special attack vectors.)

Is there any reason why the snippet above has not simply been added to assets/order_entries.publish.js?

[nitriques]

Is there any reason why the snippet above has not simply been added to assets/order_entries.publish.js

Laziness is the culprit. If you want, please send a PR and I'll release. Thanks.

[nitriques]

I was feeling bad, so I fixed it. I am also trying to remove 'unsafe inline' from my CSP directives.

@michael-e Can you test the latest integration i.e. 2.3.7 ? Thanks.

[michael-e]

It works fine for me, but I have no real-life test case for filtered or paginated ordering. (I have not used these features in my projects.)

[nitriques]

Me neither. But it was working on my 'test' setup... So I ship ?

[michael-e]

Hmmm, yes, I would ship it. But is it a bugfix? I mean, shouldn't it be v2.4.0?

[twiro]

I tested it too... looks good in normal mode (apart from my general issues with the current behavior of this extension). Looks also good when using it combined with pagination. But I haven't tested filtered ordering yet... but might do so today!

[nitriques]

But is it a bugfix?

No a security patch. Not a new feature. Shipped as 2.3.7