From d939de17df08b7a2ff8302869981f4fc88566cd9 Mon Sep 17 00:00:00 2001
From: Sheogorath
Date: Fri, 30 Mar 2018 16:33:32 +0200
Subject: Fix CSP for disqus and Google Analytics

This commit should fix existing problems with Disqus and Google
Analytics enabled in the meta-yaml section of a note.

Before this commit they were blocked by the strict CSP. It's still
possible to disable the added directives using `addDisqus` and
`addGoogleAnalytics` in the `csp` config section.

They are enabled by default to prevent breaking changes.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
---
 public/views/shared/disqus.ejs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'public/views/shared/disqus.ejs')

diff --git a/public/views/shared/disqus.ejs b/public/views/shared/disqus.ejs
index cceaa85c..840d1e38 100644
--- a/public/views/shared/disqus.ejs
+++ b/public/views/shared/disqus.ejs
@@ -1,14 +1,13 @@
 <div id="disqus_thread"></div>
-<script>
+<script nonce="<%= cspNonce %>">
 var disqus_config = function () {
     this.page.identifier = window.location.pathname.split('/').slice(-1)[0];
 };
 (function() {
     var d = document, s = d.createElement('script');
-    s.src = '//<%= disqus %>.disqus.com/embed.js';
+    s.src = 'https://<%= disqus %>.disqus.com/embed.js';
     s.setAttribute('data-timestamp', +new Date());
     (d.head || d.body).appendChild(s);
 })();
 </script>
 <noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
-                                    
\ No newline at end of file
-- 
cgit v1.2.3