How to use a variable from a plugin within functions-html.php

[Papillone]

Hello,

I'm writing my first plugin, which adds a Content Security Policy in the meta equiv attribute.
It includes a dynamic nonce which I want to use in functions-html.php.

How can I access the variable $papi_dynamic_nonce of my plugin in functions_html.php?
Trying
<script type="text/javascript" nonce='<?php echo $papi_dynamic_nonce ?>'> or
<?php global $papi_dynamic_nonce; echo $papi_dynamic_nonce; ?>
does not produce the desired result. The variable don't exist in this scope.

// No direct call
if( !defined( 'YOURLS_ABSPATH' ) ) die();

// Creating dynamic nonce function
function papi_create_nonce($length = 32) {
  // Generate a random string of the desired length
  $papi_nonce = bin2hex(random_bytes($length / 2));

  // Return the nonce
  return $papi_nonce;
}

// Adding CSP into Header
function papi_my_csp() {
	// Create nonce
	$papi_dynamic_nonce = papi_create_nonce();
	
	// Insert CSP in meta
	echo '<meta http-equiv="Content-Security-Policy" content="
		default-src \'none\';
		form-action \'self\';
		font-src \'self\';
		base-uri \'self\';
		img-src \'self\';
		style-src \'self\';
		script-src \'self\'
		\'nonce-' . $papi_dynamic_nonce .'\';"
		/>';
	return $papi_dynamic_nonce;
}

	
// Now hook our custom function into the 'html_head_meta' event
yourls_add_action( 'html_head_meta', 'papi_my_csp');

Thanks for helping a novice!

Papillon

[ozh]

You can use global. You simply have to declare it also within the function that uses the global var, see for instance https://3v4l.org/gC1Oe

In your case :

<?php

global $papi_nonce;
$papi_nonce = papi_create_nonce();

function papi_create_nonce($length = 32) {
    global $papi_nonce;
    // ...
    return $papi_nonce;
}

function papi_my_csp() {
    global $papi_nonce;
    echo '<meta ...' . $papi_nonce . '....>';
}

You could also use the built-in nonce API, eg replace your custom nonce function with a call to yourls_create_nonce('papi-CSP'). The resulting string would be unique to the YOURLS install and the current time frame.

[Papillone]

Thank you! That does the trick!