7 files changed, 21 insertions, 22 deletions
diff --git a/public/js/extra.js b/public/js/extra.js
index ec7d39da..dbb0f458 100644
--- a/public/js/extra.js
+++ b/public/js/extra.js
@@ -713,11 +713,11 @@ $.fn.sortByDepth = function () {
 function toggleTodoEvent (e) {
   const startline = $(this).closest('li').attr('data-startline') - 1
   const line = window.editor.getLine(startline)
-  const matches = line.match(/^[>\s]*[-+*]\s\[([x ])\]/)
+  const matches = line.match(/^[>\s-]*[-+*]\s\[([x ])\]/)
   if (matches && matches.length >= 2) {
     let checked = null
     if (matches[1] === 'x') { checked = true } else if (matches[1] === ' ') { checked = false }
-    const replacements = matches[0].match(/(^[>\s]*[-+*]\s\[)([x ])(\])/)
+    const replacements = matches[0].match(/(^[>\s-]*[-+*]\s\[)([x ])(\])/)
     window.editor.replaceRange(checked ? ' ' : 'x', {
       line: startline,
       ch: replacements[1].length
diff --git a/public/js/lib/common/constant.ejs b/public/js/lib/common/constant.ejs
index e4a1cf0a..c0963635 100644
--- a/public/js/lib/common/constant.ejs
+++ b/public/js/lib/common/constant.ejs
@@ -3,6 +3,8 @@ window.urlpath = '<%- urlpath %>'
 window.debug = <%- debug %>
 window.version = '<%- version %>'
 
+window.allowedUploadMimeTypes = <%- JSON.stringify(allowedUploadMimeTypes) %>
+
 window.GOOGLE_API_KEY = '<%- GOOGLE_API_KEY %>'
 window.GOOGLE_CLIENT_ID = '<%- GOOGLE_CLIENT_ID %>'
-window.DROPBOX_APP_KEY = '<%- DROPBOX_APP_KEY %>'
-\ No newline at end of file
+window.DROPBOX_APP_KEY = '<%- DROPBOX_APP_KEY %>'
diff --git a/public/js/mathjax-config-extra.js b/public/js/mathjax-config-extra.js
new file mode 100644
index 00000000..11ba59c6
--- /dev/null
+++ b/public/js/mathjax-config-extra.js
@@ -0,0 +1,8 @@
+window.MathJax = {
+  messageStyle: 'none',
+  skipStartupTypeset: true,
+  tex2jax: {
+    inlineMath: [['$', '$'], ['\\(', '\\)']],
+    processEscapes: true
+  }
+}
diff --git a/public/vendor/inlineAttachment/inline-attachment.js b/public/vendor/inlineAttachment/inline-attachment.js
index 0ffd3f9f..d9503d62 100644
--- a/public/vendor/inlineAttachment/inline-attachment.js
+++ b/public/vendor/inlineAttachment/inline-attachment.js
@@ -141,12 +141,7 @@
     /**
      * Allowed MIME types
      */
-    allowedTypes: [
-      'image/jpeg',
-      'image/png',
-      'image/jpg',
-      'image/gif'
-    ],
+    allowedTypes: window.allowedUploadMimeTypes,
 
     /**
      * Text which will be inserted when dropping or pasting a file.
@@ -304,7 +299,7 @@
     if (this.settings.onFileUploadResponse.call(this, xhr) !== false) {
       var result = JSON.parse(xhr.responseText),
         filename = result[this.settings.jsonFieldName];
-        
+
       if (result && filename) {
           var replacements = [];
           var string = this.settings.progressText.replace(this.filenameTag, id);
@@ -415,7 +410,7 @@
 // <http://wiki.ecmascript.org/doku.php?id=strawman:names>.
 //
 // The goals of this function are twofold:
-// 
+//
 // * Provide a way to generate a string guaranteed to be unique when compared
 //   to other strings generated by this function.
 // * Make the string complex enough that it is highly unlikely to be
@@ -432,4 +427,4 @@ var ID = function () {
   // Convert it to base 36 (numbers + letters), and grab the first 9 characters
   // after the decimal.
   return '_' + Math.random().toString(36).substr(2, 9);
-};
-\ No newline at end of file
+};
diff --git a/public/views/hackmd/foot.ejs b/public/views/hackmd/foot.ejs
index 16ef5737..fc971132 100644
--- a/public/views/hackmd/foot.ejs
+++ b/public/views/hackmd/foot.ejs
@@ -1,6 +1,4 @@
-<script type="text/x-mathjax-config">
-    MathJax.Hub.Config({ messageStyle: "none", skipStartupTypeset: true ,tex2jax: {inlineMath: [['$','$'], ['\\(','\\)']], processEscapes: true }});
-</script>
+<script src="<%= url %>/js/mathjax-config-extra.js"></script>
 <% if(useCDN) { %>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/spin.js/2.3.2/spin.min.js" integrity="sha256-PieqE0QdEDMppwXrTzSZQr6tWFX3W5KkyRVyF1zN3eg=" crossorigin="anonymous" defer></script>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js" integrity="sha256-hVVnYaiADRTO2PzUGmuLJr8BLUSjGIZsDYGmIJLv2b8=" crossorigin="anonymous"></script>
diff --git a/public/views/pretty.ejs b/public/views/pretty.ejs
index db72fdc4..91d9c36c 100644
--- a/public/views/pretty.ejs
+++ b/public/views/pretty.ejs
@@ -72,9 +72,7 @@
 </body>
 
 </html>
-<script type="text/x-mathjax-config">
-    MathJax.Hub.Config({ messageStyle: "none", skipStartupTypeset: true ,tex2jax: {inlineMath: [['$','$'], ['\\(','\\)']], processEscapes: true }});
-</script>
+<script src="<%= url %>/js/mathjax-config-extra.js"></script>
 <% if(useCDN) { %>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js" integrity="sha256-hVVnYaiADRTO2PzUGmuLJr8BLUSjGIZsDYGmIJLv2b8=" crossorigin="anonymous"></script>
 <script src="https://cdnjs.cloudflare.com/ajax/libs/velocity/1.4.0/velocity.min.js" integrity="sha256-bhm0lgEt6ITaZCDzZpkr/VXVrLa5RP4u9v2AYsbzSUk=" crossorigin="anonymous" defer></script>
diff --git a/public/views/slide.ejs b/public/views/slide.ejs
index 3572476f..942add4f 100644
--- a/public/views/slide.ejs
+++ b/public/views/slide.ejs
@@ -41,7 +41,7 @@
         <link rel="stylesheet" href="<%- url %>/css/slide.css">
 
         <!-- Printing and PDF exports -->
-        <script>
+        <script nonce="<%= cspNonce %>">
             var link = document.createElement( 'link' );
             link.rel = 'stylesheet';
             link.type = 'text/css';
@@ -89,9 +89,7 @@
             </div>
         </div>
 
-        <script type="text/x-mathjax-config">
-            MathJax.Hub.Config({ messageStyle: "none", skipStartupTypeset: true ,tex2jax: {inlineMath: [['$','$'], ['\\(','\\)']], processEscapes: true }});
-        </script>
+        <script src="<%= url %>/js/mathjax-config-extra.js"></script>
         <% if(useCDN) { %>
         <script src="https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.3.0/lib/js/head.min.js" integrity="sha256-+09kLhwACKXFPDvqo4xMMvi4+uXFsRZ2uYGbeN1U8sI=" crossorigin="anonymous"></script>
         <script src="https://cdnjs.cloudflare.com/ajax/libs/reveal.js/3.3.0/js/reveal.min.js" integrity="sha256-lvaInSKflJWLPqf5N5oHr/UZFwXKD6gckerdwoHqECY=" crossorigin="anonymous"></script>