title: Chrome Extension - permission problems
body: <p>I'm building an extension.  One of the parts of the extension is to display an output from a VOIP server, using Javascript.</p>
  
  <p>I'm using this one: <a href="https://github.com/CommandChannel/Mumble-Channel-Viewer/wiki" rel="nofollow">https://github.com/CommandChannel/Mumble-Channel-Viewer/wiki</a></p>
  
  <p>I've adjusted the content, so that the JS is inside my popup.js file, along with the var declared (so no inline JS).</p>
  
  <p>The JSON output for the server is at: <a href="http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1" rel="nofollow">http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1</a> which is modified to: <a href="http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1?callback=" rel="nofollow">http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1?callback=</a>? as the instructions say.</p>
  
  <p>However, I'm getting the error:</p>
  
  <pre><code>Refused to load the script 'http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1?callback=jQuery1910587204567855224_1369671235456&amp;_=1369671235457' because it violates the following Content Security Policy directive: "script-src 'self' chrome-extension-resource:".
  </code></pre>
  
  <p>Now I've done loads of looking around, and it seems JSONP callback isn't allowed if the domain isn't https:// (?)</p>
  
  <p>My manifest has these permissions:</p>
  
  <pre><code>"permissions": [
      "http://*.lethal-zone.eu/*", 
      "https://*.lethal-zone.eu/*",
      "http://api.lethal-zone.eu/mumble/",
      "notifications",
      "storage"
  ],
  </code></pre>
  
  <p>Does anyone know how I could go about doing this without https? Or where I should be looking?</p>
  
  <p>EDIT: Not much code to show, I have my div: <code>&lt;div id="mumbleTree"&gt;&lt;/div&gt;</code>, then the javascript from <a href="https://github.com/CommandChannel/Mumble-Channel-Viewer/blob/master/JavaScript/mumbleViewer.js" rel="nofollow">https://github.com/CommandChannel/Mumble-Channel-Viewer/blob/master/JavaScript/mumbleViewer.js</a> is loaded, using <code>var mumbleChannelViewerJsonUri = "http://api.lethal-zone.eu/mumble/?view=json&amp;serverId=1?callback=?";</code> as explained in these instructions: <a href="https://github.com/CommandChannel/Mumble-Channel-Viewer/wiki/Installation-instructions" rel="nofollow">https://github.com/CommandChannel/Mumble-Channel-Viewer/wiki/Installation-instructions</a></p>
  
  <p>Cheers</p>