0

There is the old way to add custom script to SharePoint is by allowing custom script on the sites and adding the build in script editor web parts, where only users with ""Add and Customize Pages"" permission can add custom script, so in case we enable custom script we still have some control that only users with "Add and Customize Pages" permission can do so.

now if we do not want to allow custom scripts on the site and at the same time we want to add some script editor web parts to modern pages, then we can use the modern script editor web part @ https://github.com/pnp/sp-dev-fx-webparts/tree/master/samples/react-script-editor. But adding this modern script editor web part will allow contributor users (unlike the classic script editor web part) to add custom scripts to modern pages..

so my question if it is a bad practice to install the modern script editor web part App inside our modern sites? second question, is there a way to prevent adding modern script editor web parts unless the user has "Add and Customize Pages" permission, as in the classic script editor web part?

Thanks

0

I wouldn't recommend allowing all users the ability to add the Modern Script Editor Web Part. If any user can add this web part to a page, then it could become a security concern e.g. users could add JavaScript to a page which is unsafe.

Additionally, if you are using the Modern Script Editor Web Part to manipulate other default web parts or the top navigation bar then this is also bad practice and is not supported by Microsoft. Customisations should be done using SPFx web parts or extensions.

Customizing "modern" site pages

1
  • thanks for the reply, but you did not answer my questions – john Gu Mar 9 at 21:07
0

The point of using modern script editor web part is to add custom code on modern pages, it can hardly be called “bad practice” if your tenant has such needs on development.

It is not possible to set restriction to who can use (SPFx) web parts on modern pages for the time being.

Once the modern script editor web part is deployed, every internal user who has permission to edit a site page will have access to this web part.

2
  • based on my reading it is a bad practice since end users can add JavaScript on the pages, and those JavaScript get run under the current user context,, so any thing the user can do the JavaScript will be able to do, which is considered as a bad practice .. and i think i do agree.. at least on classic pages only users with Full control + Design permission level can add custom scripts, but with using the modern script editor adding custom script is available to all users who can edit the modern pages (in other word almost all users!!!) – john Gu Mar 10 at 10:56
  • @johnGu This web part provides an easy way to add customization on modern page, and it leaves the decision to use it or not all to you. I think it is better to notice end users, especially when you give “almost all users” Edit privilege on modern pages, the benefit and also consequences of using this web part (and other web parts as well). – Chelsea_MSFT Mar 11 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.