summaryrefslogtreecommitdiff
path: root/public/views/shared
diff options
context:
space:
mode:
authorSheogorath2018-03-30 16:33:32 +0200
committerSheogorath2018-03-30 16:33:52 +0200
commitd939de17df08b7a2ff8302869981f4fc88566cd9 (patch)
tree928502f8fef68664f43a8f2443c50de745312d18 /public/views/shared
parentd2cce7638a78ca7616607217b179c15915452058 (diff)
Fix CSP for disqus and Google Analytics
This commit should fix existing problems with Disqus and Google Analytics enabled in the meta-yaml section of a note. Before this commit they were blocked by the strict CSP. It's still possible to disable the added directives using `addDisqus` and `addGoogleAnalytics` in the `csp` config section. They are enabled by default to prevent breaking changes. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Diffstat (limited to 'public/views/shared')
-rw-r--r--public/views/shared/disqus.ejs5
-rw-r--r--public/views/shared/ga.ejs6
2 files changed, 5 insertions, 6 deletions
diff --git a/public/views/shared/disqus.ejs b/public/views/shared/disqus.ejs
index cceaa85c..840d1e38 100644
--- a/public/views/shared/disqus.ejs
+++ b/public/views/shared/disqus.ejs
@@ -1,14 +1,13 @@
<div id="disqus_thread"></div>
-<script>
+<script nonce="<%= cspNonce %>">
var disqus_config = function () {
this.page.identifier = window.location.pathname.split('/').slice(-1)[0];
};
(function() {
var d = document, s = d.createElement('script');
- s.src = '//<%= disqus %>.disqus.com/embed.js';
+ s.src = 'https://<%= disqus %>.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
- \ No newline at end of file
diff --git a/public/views/shared/ga.ejs b/public/views/shared/ga.ejs
index 66d4acd9..27abb742 100644
--- a/public/views/shared/ga.ejs
+++ b/public/views/shared/ga.ejs
@@ -1,5 +1,5 @@
<% if(typeof GA !== 'undefined' && GA) { %>
-<script>
+<script nonce="<%= cspNonce %>">
(function (i, s, o, g, r, a, m) {
i['GoogleAnalyticsObject'] = r;
i[r] = i[r] || function () {
@@ -10,9 +10,9 @@
a.async = 1;
a.src = g;
m.parentNode.insertBefore(a, m)
-})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
+})(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
ga('create', '<%= GA %>', 'auto');
ga('send', 'pageview');
</script>
-<% } %> \ No newline at end of file
+<% } %>