Third party code from 'polyfill.io' and it's removal from Sellerdeck software

[G.W.Green]

We have recently become aware of problems seen with an externally hosted JavaScript library used by the software.

The file used is called 'polyfill.min.js' and is called from a site called 'polyfill.io'.

The library was included to support IE11, and was added in versions 18.0.4 and 16.0.6. It is no longer needed however, as IE usage is extremely low and now the external hosting server for the library has become unreliable.

Some of the issues that can be seen are:-

• All payment methods on the final checkout page disappearing
• Any ads you have with Google, will be disapproved.

It is highly recommended that you remove references to this library to ensure that your customers always have a way to pay for their orders.

With regard to Google, this is what they have to say: -

We've detected a security issue that may be affecting websites using specific third-party libraries (like 'polyfill.io', 'bootcss.com', and others). This issue can sometimes redirect visitors away from the intended website without the website owner's knowledge or permission.

Why is this happening?

The code causing these redirects seems to be coming from a few different third-party web resource providers.

What does this mean for your Google Ads?

If we find these redirects during our regular checks of your ad destinations, we'll need to disapprove the related ads. This is due to our Compromised Sites Policy, which aims to protect users from websites with unauthorized code modifications.

You can easily check if your site is using the library:

1. Open the site
2. Navigate to a product page. This will show you the folder where Sellerdeck Desktop files are stored on the server, usually acatalog
3. Amend the URL and add "/order02.html" after the folder - e.g. "https://www.mysite.co.uk/acatalog/order02.html".
4. Open the page. You will see the template used for your checkout payment page, with lots of placeholders for the order details.
5. View the source of the page. This varies by browser, but try right-clicking on the page and selecting 'View Source' from the menu. This should open another tab with the page source.
6. In the page source look for 'callback=polyFillsLoaded'. Normally you use ctrl+F to open the 'Find' box.

If the text is present then the script call is there and needs removing.

To fix this, please go to ‘Design | Library | Layouts’ and scroll down to the ‘Javascript Header Functions’ group and expand it.

Open the layout ‘Standard Javascript Header Functions’ and move down the code until you see the line: -

<script defer crossorigin="anonymous" src="https://polyfill.io/v3/polyfill.min.js?flags=gated&callback=polyFillsLoaded&features=fetch%2CPromise"></script>

Remove this code and replace it with the following: -

<script type="text/javascript">
$(document).ready(function() {
$(".usesFetch").show();
});
</script>

And click ‘OK’ to save the layout.

Once you have done this Publish the site for the changes to take place online.