In function drupal_add_js()

Consider following scenario

base_path() returns "/"
$file contains "http://www.google...";

call: drupal_add_js("http://www.googleanalytics....");

Instead of producing
script type="text/javascript" src="http://www.googleanalystics.com/urchin.js">

Reason: because of base_path prefix(). Please consider fixing this. I'm not suggesting to remove base_path() as prefix (as that would certainly break other things).

CommentFileSizeAuthor
#2 common_15.patch493 bytespaddy_deburca

Comments

apatel’s picture

apatel commented

In function drupal_add_js()

Consider following scenario

base_path() returns "/"
$file contains "http://www.google...";

call: drupal_add_js("http://www.googleanalytics....");

Instead of producing
GTscript type="text/javascript" src="http://www.googleanalystics.com/urchin.js"LTGTscriptLT

The above call in that particular scenario will produce:
GTscript type="text/javascript" src="//www.googleanalystics.com/urchin.js"LTGT/scriptLT

(pardon the GT LT's apparently i can't pick format as plain text).

Reason: because of base_path prefix(). Please consider fixing this. I'm not suggesting to remove base_path() as prefix (as that would certainly break other things).

paddy_deburca’s picture

paddy_deburca commented
Status: Active » Needs review
StatusFileSize
new common_15.patch493 bytes

I cannot comment on the security implications of including 3rd party scripts in one's own website.

This may be necessary for some google-like applications.

Try this patch to test if the URL is a valid URL with all the http://, https:// or ftp:// bits 'n pieces.

Paddy.

chx’s picture

chx commented
Version: 4.7.0-beta5 » x.y.z
Category: bug » feature

this is to add Drupal JS scripts. Use drupal_set_html_head IMO.

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Needs review » Closed (won't fix)

I agree with chx. We don't need to put in extra logic for third party scripts that can be added with drupal_set_html_head(). I don't see the lack of duplicate detection (main feature of drupal_add_js()) as being a problem for the Google example.