Ghost: Stripe javascript file is loaded even if no stripe connection is setup

[christian-kolb]

Issue Summary

When enabling members but not paid members (without stripe connection), the stripe javascript is still loaded on the blog.

The load time hit is quite substantial, it would be great if would only be added if the stripe API key is set.

To Reproduce

1. Enable members, but no stripe payment
2. Load the frontend
3. Stripe javascript file is loaded

Technical details:

• Ghost Version: 3.1.1
• Node Version: All
• Browser/OS: All
• Database: All

In the ghost_head.js file in the helpers folder, there is just no difference at the moment:

function getMembersHelper() {
    return `
        <script src="https://js.stripe.com/v3/"></script>
        <script defer src="${getAssetUrl('public/members.js')}"></script>
    `;
}

[svenewers]

I've published a pull request with a simple fix for this issue (see above). It should be noted that this issue is potentially even more problematic for people running their own sites in GDPR countries.

Stripe.js sets cookies that probably require extra attention in a site's privacy policy. If the people running their site's don't add Stripe in their privacy policy because they don't expect Ghost to load Stripe because they just haven't configured it (a reasonable assumption imho), that could potentially cause problems.