gitea/nas
1
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Add subresource integrity for JS and CSS assets (#15096)

Browse source 
Fix #2744
This commit is contained in:
Eugen Rochko 2020-11-06 11:56:31 +01:00 • committed by GitHub
parent 68d4b2b83e
commit 9b1f2a4b61
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
31 changed files with 79 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/views/layouts/admin.html.haml
View file

@ -1,6 +1,6 @@
- content_for :header_tags do
= render_initial_state
= javascript_pack_tag 'public', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag 'public', crossorigin: 'anonymous'
- content_for :content do
.admin-wrapper

8
app/views/layouts/application.html.haml
View file

@ -21,10 +21,10 @@
%title= content_for?(:page_title) ? safe_join([yield(:page_title).chomp.html_safe, title], ' - ') : title
= stylesheet_pack_tag 'common', media: 'all'
= stylesheet_pack_tag current_theme, media: 'all'
= javascript_pack_tag 'common', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag "locale_#{I18n.locale}", integrity: true, crossorigin: 'anonymous'
= stylesheet_pack_tag 'common', media: 'all', crossorigin: 'anonymous'
= stylesheet_pack_tag current_theme, media: 'all', crossorigin: 'anonymous'
= javascript_pack_tag 'common', crossorigin: 'anonymous'
= javascript_pack_tag "locale_#{I18n.locale}", crossorigin: 'anonymous'
= csrf_meta_tags
%meta{ name: 'style-nonce', content: request.content_security_policy_nonce }

2
app/views/layouts/auth.html.haml
View file

@ -1,5 +1,5 @@
- content_for :header_tags do
= javascript_pack_tag 'public', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag 'public', crossorigin: 'anonymous'
- content_for :content do
.container-alt

4
app/views/layouts/embedded.html.haml
View file

@ -11,8 +11,8 @@
- if storage_host?
%link{ rel: 'dns-prefetch', href: storage_host }/
= stylesheet_pack_tag 'common', media: 'all'
= stylesheet_pack_tag Setting.default_settings['theme'], media: 'all'
= stylesheet_pack_tag 'common', media: 'all', crossorigin: 'anonymous'
= stylesheet_pack_tag Setting.default_settings['theme'], media: 'all', crossorigin: 'anonymous'
= javascript_pack_tag 'common', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag "locale_#{I18n.locale}", integrity: true, crossorigin: 'anonymous'
= render_initial_state

8
app/views/layouts/error.html.haml
View file

@ -5,10 +5,10 @@
%meta{ charset: 'utf-8' }/
%title= safe_join([yield(:page_title), Setting.default_settings['site_title']], ' - ')
%meta{ content: 'width=device-width,initial-scale=1', name: 'viewport' }/
= stylesheet_pack_tag 'common', media: 'all'
= stylesheet_pack_tag Setting.default_settings['theme'], media: 'all'
= javascript_pack_tag 'common', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag 'error', integrity: true, crossorigin: 'anonymous'
= stylesheet_pack_tag 'common', media: 'all', crossorigin: 'anonymous'
= stylesheet_pack_tag Setting.default_settings['theme'], media: 'all', crossorigin: 'anonymous'
= javascript_pack_tag 'common', crossorigin: 'anonymous'
= javascript_pack_tag 'error', crossorigin: 'anonymous'
%body.error
.dialog
.dialog__illustration

2
app/views/layouts/modal.html.haml
View file

@ -1,5 +1,5 @@
- content_for :header_tags do
= javascript_pack_tag 'public', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag 'public', crossorigin: 'anonymous'
- content_for :content do
- if user_signed_in? && !@hide_header

2
app/views/layouts/public.html.haml
View file

@ -1,6 +1,6 @@
- content_for :header_tags do
= render_initial_state
= javascript_pack_tag 'public', integrity: true, crossorigin: 'anonymous'
= javascript_pack_tag 'public', crossorigin: 'anonymous'
- content_for :content do
.public-layout