diff options
| author | Sheogorath | 2018-03-30 16:33:32 +0200 |
|---|---|---|
| committer | Sheogorath | 2018-03-30 16:33:52 +0200 |
| commit | d939de17df08b7a2ff8302869981f4fc88566cd9 (patch) | |
| tree | 928502f8fef68664f43a8f2443c50de745312d18 /public/views/shared | |
| parent | d2cce7638a78ca7616607217b179c15915452058 (diff) | |
Fix CSP for disqus and Google Analytics
This commit should fix existing problems with Disqus and Google
Analytics enabled in the meta-yaml section of a note.
Before this commit they were blocked by the strict CSP. It's still
possible to disable the added directives using `addDisqus` and
`addGoogleAnalytics` in the `csp` config section.
They are enabled by default to prevent breaking changes.
Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Diffstat (limited to 'public/views/shared')
| -rw-r--r-- | public/views/shared/disqus.ejs | 5 | ||||
| -rw-r--r-- | public/views/shared/ga.ejs | 6 |
2 files changed, 5 insertions, 6 deletions
diff --git a/public/views/shared/disqus.ejs b/public/views/shared/disqus.ejs index cceaa85c..840d1e38 100644 --- a/public/views/shared/disqus.ejs +++ b/public/views/shared/disqus.ejs @@ -1,14 +1,13 @@ <div id="disqus_thread"></div> -<script> +<script nonce="<%= cspNonce %>"> var disqus_config = function () { this.page.identifier = window.location.pathname.split('/').slice(-1)[0]; }; (function() { var d = document, s = d.createElement('script'); - s.src = '//<%= disqus %>.disqus.com/embed.js'; + s.src = 'https://<%= disqus %>.disqus.com/embed.js'; s.setAttribute('data-timestamp', +new Date()); (d.head || d.body).appendChild(s); })(); </script> <noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript> -
\ No newline at end of file diff --git a/public/views/shared/ga.ejs b/public/views/shared/ga.ejs index 66d4acd9..27abb742 100644 --- a/public/views/shared/ga.ejs +++ b/public/views/shared/ga.ejs @@ -1,5 +1,5 @@ <% if(typeof GA !== 'undefined' && GA) { %> -<script> +<script nonce="<%= cspNonce %>"> (function (i, s, o, g, r, a, m) { i['GoogleAnalyticsObject'] = r; i[r] = i[r] || function () { @@ -10,9 +10,9 @@ a.async = 1; a.src = g; m.parentNode.insertBefore(a, m) -})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga'); +})(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga'); ga('create', '<%= GA %>', 'auto'); ga('send', 'pageview'); </script> -<% } %>
\ No newline at end of file +<% } %> |