• Resolved Name


    If I define a Content Security Policy (CSP) in the http headers with script-src: ‘self’ (and also explicit urls to my site) the drop-down lists of annual archive do not work. I have to enable script-src: ‘unsafe-inline’ in addition to other allowed script sources. What is the problem?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Contributor twinpictures


    Please check that no other plugin or theme is using a filter to inject the unwanted JS, as our plugin is not using any inline scripts directly.

    Thread Starter Name


    Thank you for your swift reply. I decided to look around.

    I found out that this problem is not caused by your plugin at all, but by WordPress itself. Fixing this security weakness of core wp has been postponed since 2015.

    The inline javascript that prevents proper use of CSP (and opens doors to XSS), comes from blocks/categories.php and widgets/class-wp-widget-categories.php

    I have been very happy with your plugin. It made our little Archives page so much better 🙂

    • This reply was modified 4 years ago by Name.
    Plugin Contributor twinpictures


    glad you got to the bottom of that!
    We’ll marke the issue as resolved.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Annual archive seems to require CSP script-src: ‘unsafe-inline’ ???’ is closed to new replies.