From 0e81a0722e30598768aff2dadcddf3ab3d3f8c83 Mon Sep 17 00:00:00 2001
From: Inndy <inndy.tw@gmail.com>
Date: Mon, 19 Jul 2021 21:44:55 +0800
Subject: [PATCH] Discard Referer header from iframe and link to original URL

---
 archivebox/templates/core/snapshot.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/archivebox/templates/core/snapshot.html b/archivebox/templates/core/snapshot.html
index d562d038..ccb74227 100644
--- a/archivebox/templates/core/snapshot.html
+++ b/archivebox/templates/core/snapshot.html
@@ -416,12 +416,14 @@
                     {% endif %}
                     <div class="col-lg-2">
                         <div class="card">
-                            <iframe class="card-img-top" src="{{url}}" sandbox="allow-same-origin allow-top-navigation-by-user-activation allow-scripts allow-forms" scrolling="no" loading="lazy"></iframe>
+                            <iframe class="card-img-top" src="{{url}}" sandbox="allow-same-origin allow-top-navigation-by-user-activation allow-scripts allow-forms" scrolling="no" loading="lazy" referrerpolicy="no-referrer"></iframe>
                             <div class="card-body">
-                                <a href="{{url}}" title="Open in new tab..." target="_blank" rel="noopener">
+                                <a href="{{url}}" title="Open in new tab..." target="_blank" rel="noopener" referrerpolicy="no-referrer">
                                     <p class="card-text"><code>🌐 {{domain}}</code></p>
                                 </a>
-                                <a href="{{url}}" target="preview" id="original-btn"><h4 class="card-title">Original</h4></a>
+                                <a href="{{url}}" target="preview" id="original-btn" referrerpolicy="no-referrer">
+                                    <h4 class="card-title">Original</h4>
+                                </a>
                           </div>
                         </div>
                     </div>