From 7fe7be7ef8338b1a37026c6328b0822642012298 Mon Sep 17 00:00:00 2001
From: Blake Erickson <o.blakeerickson@gmail.com>
Date: Wed, 24 Apr 2024 11:38:56 -0600
Subject: [PATCH] add nonce to pricing-table.js

---
 plugin.rb | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/plugin.rb b/plugin.rb
index c1e9980..f06a458 100644
--- a/plugin.rb
+++ b/plugin.rb
@@ -21,11 +21,17 @@ register_svg_icon "far-credit-card" if respond_to?(:register_svg_icon)
 register_html_builder("server:before-head-close") do |controller|
   "<script src='https://js.stripe.com/v3/' nonce='#{controller.helpers.csp_nonce_placeholder}'></script>"
 end
-register_html_builder("server:before-head-close") do
-  '<script async src="https://js.stripe.com/v3/pricing-table.js"></script>'
+register_html_builder("server:before-head-close") do |controller|
+  "<script async src='https://js.stripe.com/v3/pricing-table.js' nonce='#{controller.helpers.csp_nonce_placeholder}'></script>"
 end
 
-extend_content_security_policy(script_src: %w[https://js.stripe.com/v3/ https://hooks.stripe.com https://js.stripe.com/v3/pricing-table.js])
+extend_content_security_policy(
+  script_src: %w[
+    https://js.stripe.com/v3/
+    https://hooks.stripe.com
+    https://js.stripe.com/v3/pricing-table.js
+  ],
+)
 
 add_admin_route "discourse_subscriptions.admin_navigation", "discourse-subscriptions.plans"