mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-06-01 07:38:33 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix CSP for disqus and Google Analytics

Browse source 
This commit should fix existing problems with Disqus and Google
Analytics enabled in the meta-yaml section of a note.

Before this commit they were blocked by the strict CSP. It's still
possible to disable the added directives using `addDisqus` and
`addGoogleAnalytics` in the `csp` config section.

They are enabled by default to prevent breaking changes.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit is contained in:
Sheogorath 2018-03-30 16:33:32 +02:00
parent d2cce7638a
commit d939de17df
No known key found for this signature in database
GPG key ID: 1F05CC3635CDDFFD
6 changed files with 25 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
public/views/shared/disqus.ejs
View file

@ -1,14 +1,13 @@
<div id="disqus_thread"></div>
<script>
<script nonce="<%= cspNonce %>">
var disqus_config = function () {
this.page.identifier = window.location.pathname.split('/').slice(-1)[0];
};
(function() {
var d = document, s = d.createElement('script');
s.src = '//<%= disqus %>.disqus.com/embed.js';
s.src = 'https://<%= disqus %>.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>

6
public/views/shared/ga.ejs
View file

@ -1,5 +1,5 @@
<% if(typeof GA !== 'undefined' && GA) { %>
<script>
<script nonce="<%= cspNonce %>">
(function (i, s, o, g, r, a, m) {
i['GoogleAnalyticsObject'] = r;
i[r] = i[r] || function () {
@ -10,9 +10,9 @@
a.async = 1;
a.src = g;
m.parentNode.insertBefore(a, m)
})(window, document, 'script', '//www.google-analytics.com/analytics.js', 'ga');
})(window, document, 'script', 'https://www.google-analytics.com/analytics.js', 'ga');
ga('create', '<%= GA %>', 'auto');
ga('send', 'pageview');
</script>
<% } %>
<% } %>