@julian Any updates on nodebb's CSP implementation? I'd like to avoid unsafe-* for obvious reasons.
Retrieving plugin settings
ericmiao last edited by
Which one of the below approaches is preferred? and what's the difference?
- meta.settings.get(key, callback)
This has 3 parts:
(Whoops, 4 - actually. Jump to 4 if you get the feeling, that I've spread it on too thick with the lecture. )
- What are they?
meta.settings.get(key, cb) is a function call, whereas
meta.config[key] is a way of accessing an Array or Object. Here it is an Object.
- What are they doing?
meta.settings.get is pretty easy to spot, since you only have to search for the name. When looking for something like this I tend to use something like
settings.get =, rather than
settings.get. This thins out the search results, hopefully down to one, since we avoid all calls of that function, which have the paranthesis following the name.
Now, here I found: https://github.com/NodeBB/NodeBB/blob/master/src/meta/settings.js#L10
This db.getObject is obviously some kind of query to the database, the result of that is passed to its own callback function, wherein the actual
callbackis called with the result of that query or an empty Object. At this point, mind the
'settings:', which indicates where to look in the database.
meta.config[key] is accessing an Object. A very important distinction is implied: It's an object, that has been created at one point in time, and now is only accessed. You don't change any values, or call a function, that would do so; unless you do it with
=, of course. But as it is, you'd only access a field/member in/of that Object, named after whatever the value of that variable
keyis. You can find the code where this Object is created (or populated) at: https://github.com/NodeBB/NodeBB/blob/master/src/meta/configs.js#L14
In line 17 Meta.configs.list is called, also issuing a query to the database. But this time, it's only
'config'as querystring, without chaining
hashor something. That's important, because now we do know what we are looking for. Where? Well, in the database of course.
Which then, kinda, answers
- What information do they hold?
As you might have already seen from the picture:
meta.settings.get(key, cb) is accessing the Object stored in the database with the descriptor
settings: + valueOfKey; which would e.g. be
settings:shortcuts. Those actually are settings of PlugIns!
If you have a look at the content of
config(remember? No added
keyor something in the db-query. Just plain and simple
confighere.), you can see config values regarding NodeBB itself. So:
4. tl;dr bypass:
In meta.settings.get(key, cb) - KEY means the name of a plugin you want to receive ALL settings for in one Object.
In meta.config[key] - KEY means the name of only one config value from the NodeBB config.
I can also just encourage you to install something like Redis Desktop Manager and go the heck nuts on your database. It's super fun, like being on a safari, discovering new species. Run your NBB instance aside, post something; refresh and compare. Oh, I can feel the :neckbeard: growing, already.
@rbeer isn't code archaeology fun?
The settings in
meta.config, we coloquially call "settings v1". It was the only settings system for awhile, so occasionally, you will see that it contains settings for certain plugins.
Plugins should use settings v2, which is
meta.settings.get()/.set(). That saves the plugin settings in a separate hash, away from NodeBB settings.
It sure is! I wasn't aware that I was actually tripping over fossils along the way. But now, that you've mentioned it, I found e.g. the plugin-cash settings in
I'll be at the weaponsmith's sharpening my sword, then - heeyahh!