- 2 minutes to read

DashboardPluginSettings - System Parameter

New 7.4.0

DashboardPluginSettings is a JSON System Parameter that sets what Custom Dashboard Items (HTML dashboard plugins) may do inside their iframe sandbox in the Nodinite Web Client: run JavaScript, load external content or scripts, and call external servers.

At a Glance

Property Value
Key DashboardPluginSettings
Data type json
Default {"AllowScripts":false,"AllowExternalContent":false,"AllowExternalCalls":false,"AllowExternalScripts":false}
Read by Web Client
Takes effect Within about 15 seconds; no restart needed
Status ✅ Active
Since Nodinite 7.4.0

How It Works

The parameter only matters when your Product Key includes the Custom Dashboard feature. Without it, the Web Client shows no custom dashboard plugins, whatever this parameter says. To get the feature, contact Nodinite support; licence changes are made in Manage License.

With the feature, the Web Client loads each plugin in a sandboxed iframe and lifts only the restrictions you set to true. Content sanitization of the plugin HTML still applies; see Custom Dashboard Items for what the sanitizer removes, where the plugin files go, and how to troubleshoot them.

Value Format

Property Type Default Meaning when true
AllowScripts boolean false JavaScript runs inside the plugin iframe.
AllowExternalContent boolean false The plugin may load external images, fonts, and CSS files.
AllowExternalCalls boolean false The plugin may call APIs on external servers.
AllowExternalScripts boolean false The plugin may load JavaScript files from CDNs or other external sources.

Example that lets a plugin run JavaScript against the internal Web API, for example a Log View counter, while keeping all external access blocked:

{
  "AllowScripts": true,
  "AllowExternalContent": false,
  "AllowExternalCalls": false,
  "AllowExternalScripts": false
}

Choosing a Value

Start from the default and set only what a plugin needs:

Plugin AllowScripts AllowExternalContent AllowExternalCalls AllowExternalScripts
Static HTML announcements and environment badges ❌ No ❌ No ❌ No ❌ No
Log View counters through the internal Web API ✅ Yes ❌ No ❌ No ❌ No
Embedded Power BI report ✅ Yes ✅ Yes ✅ Yes ❌ No

Warning

Each true widens what plugin HTML can do in your users' browsers. Deploy only plugin files you have reviewed, and keep the all-true configuration to test environments with trusted content.

Next Steps