2

There is the old way to add custom script to SharePoint is by allowing custom script on the sites and adding the build in script editor web parts, where only users with ""Add and Customize Pages"" permission can add custom script, so in case we enable custom script we still have some control that only users with "Add and Customize Pages" permission can do so.

now if we do not want to allow custom scripts on the site and at the same time we want to add some script editor web parts to modern pages, then we can use the modern script editor web part @ https://github.com/pnp/sp-dev-fx-webparts/tree/master/samples/react-script-editor. But adding this modern script editor web part will allow contributor users (unlike the classic script editor web part) to add custom scripts to modern pages..

so my question if it is a bad practice to install the modern script editor web part App inside our modern sites? second question, is there a way to prevent adding modern script editor web parts unless the user has "Add and Customize Pages" permission, as in the classic script editor web part?

Thanks

Improve this question

2 Answers 2

Reset to default
1

I wouldn't recommend allowing all users the ability to add the Modern Script Editor Web Part. If any user can add this web part to a page, then it could become a security concern e.g. users could add JavaScript to a page which is unsafe.

Additionally, if you are using the Modern Script Editor Web Part to manipulate other default web parts or the top navigation bar then this is also bad practice and is not supported by Microsoft. Customisations should be done using SPFx web parts or extensions.

Customizing "modern" site pages

Improve this answer
1
  • thanks for the reply, but you did not answer my questions
    – John John
    Mar 9, 2021 at 21:07
1

The point of using modern script editor web part is to add custom code on modern pages, it can hardly be called “bad practice” if your tenant has such needs on development.

It is not possible to set restriction to who can use (SPFx) web parts on modern pages for the time being.

Once the modern script editor web part is deployed, every internal user who has permission to edit a site page will have access to this web part.

Improve this answer
2
  • based on my reading it is a bad practice since end users can add JavaScript on the pages, and those JavaScript get run under the current user context,, so any thing the user can do the JavaScript will be able to do, which is considered as a bad practice .. and i think i do agree.. at least on classic pages only users with Full control + Design permission level can add custom scripts, but with using the modern script editor adding custom script is available to all users who can edit the modern pages (in other word almost all users!!!)
    – John John
    Mar 10, 2021 at 10:56
  • @johnGu This web part provides an easy way to add customization on modern page, and it leaves the decision to use it or not all to you. I think it is better to notice end users, especially when you give “almost all users” Edit privilege on modern pages, the benefit and also consequences of using this web part (and other web parts as well).
    – Chelsea_MSFT
    Mar 11, 2021 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.