Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6b57b051 authored by Nicolas Gelot's avatar Nicolas Gelot
Browse files

Add CSP policy 

Close: #44
parent 15c37643

etc/nginx/conf.d/spot.conf

+3 −2
Original line number Original line Diff line number Diff line
@@ -4,12 +4,13 @@ server { 
  listen 80;

  listen 80;

  server_name _;

  server_name _;





  add_header Content-Security-Policy "frame-ancestors 'self'";

  add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";

  add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";

  add_header Strict-Transport-Security "max-age=31536000";

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

  add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self' https://overpass-api.de; img-src 'self' data: https://*.tile.openstreetmap.org; frame-src https://www.youtube-nocookie.com https://player.vimeo.com https://www.dailymotion.com https://www.deezer.com https://www.mixcloud.com https://w.soundcloud.com https://embed.spotify.com";

  add_header X-Frame-Options "SAMEORIGIN";

  add_header X-Frame-Options "SAMEORIGIN";

  add_header X-XSS-Protection "1; mode=block";

  add_header X-XSS-Protection "1; mode=block";

  add_header X-Content-Type-Options "nosniff";

  add_header X-Content-Type-Options "nosniff";

  add_header X-Robots-Tag "noindex, noarchive, nofollow";





  root /var/www/spot;

  root /var/www/spot;

searx/settings.yml

+1 −1
Original line number Original line Diff line number Diff line
@@ -13,7 +13,7 @@ server: 
    bind_address : "0.0.0.0" # address to listen on

    bind_address : "0.0.0.0" # address to listen on

    secret_key : "ultrasecretkey" # change this!

    secret_key : "ultrasecretkey" # change this!

    base_url : False # Set custom base_url. Possible values: False or "https://your.custom.host/location/"

    base_url : False # Set custom base_url. Possible values: False or "https://your.custom.host/location/"

    image_proxy : False # Proxying image results through searx

    image_proxy : True # Proxying image results through searx

    http_protocol_version : "1.0"  # 1.0 and 1.1 are supported

    http_protocol_version : "1.0"  # 1.0 and 1.1 are supported





ui:

ui:

searx/static/themes/eelo/js/searx.js

+28 −25
Original line number Original line Diff line number Diff line
@@ -88,16 +88,17 @@ $(document).ready(function(){ 
        });

        });

    }

    }

});

});

;

;$(document).ready(function(){

function configure_image_view(target) {

  function configure_image_view(target, view_url) {

  document.getElementById("image_view_image").src = target.href;

    document.getElementById("image_view_image").src = view_url;

    document.getElementById("image_view_file_link").href = target.href;

    document.getElementById("image_view_file_link").href = target.href;

    document.getElementById("image_view_url_link").href = target.dataset.url;

    document.getElementById("image_view_url_link").href = target.dataset.url;

  }

  }





function show_image_view_modal(event) {

  $(".result.result-images").click(function (event) {

    event.preventDefault();

    event.preventDefault();

    var target = event.target;

    var target = event.target;

    var view_url = target.src;

    if (target.tagName == "IMG") {

    if (target.tagName == "IMG") {

        target = target.parentElement;

        target = target.parentElement;

    }

    }
@@ -105,17 +106,19 @@ function show_image_view_modal(event) { 
    var modal = document.getElementById("image_view_modal");

    var modal = document.getElementById("image_view_modal");

    modal.classList.remove("hidden");

    modal.classList.remove("hidden");

    modal.style.top = window.scrollY + "px";

    modal.style.top = window.scrollY + "px";

  configure_image_view(target);

    configure_image_view(target, view_url);

    document.body.classList.add("lock");

    document.body.classList.add("lock");

}

  });





function close_image_view_modal() {

  $("#close_image_view_modal").click(function () {

    document.getElementById("image_view_modal").classList.add("hidden");

    document.getElementById("image_view_modal").classList.add("hidden");

    document.getElementById("image_view_image").src = "";

    document.getElementById("image_view_image").src = "";

    document.getElementById("image_view_file_link").href = "#";

    document.getElementById("image_view_file_link").href = "#";

    document.getElementById("image_view_url_link").href = "#";

    document.getElementById("image_view_url_link").href = "#";

    document.body.classList.remove("lock");

    document.body.classList.remove("lock");

};/**

  });

});

;/**

 * searx is free software: you can redistribute it and/or modify

 * searx is free software: you can redistribute it and/or modify

 * it under the terms of the GNU Affero General Public License as published by

 * it under the terms of the GNU Affero General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * the Free Software Foundation, either version 3 of the License, or

searx/static/themes/eelo/js/searx.min.js

+0 −0

File changed.

Preview suppressed by a .gitattributes entry or the file's encoding is unsupported.

View original file
View changed file

searx/static/themes/eelo/js/searx_src/custom.js

+27 −25
Original line number Original line Diff line number Diff line 


$(document).ready(function(){

function configure_image_view(target) {

  function configure_image_view(target, view_url) {

  document.getElementById("image_view_image").src = target.href;

    document.getElementById("image_view_image").src = view_url;

    document.getElementById("image_view_file_link").href = target.href;

    document.getElementById("image_view_file_link").href = target.href;

    document.getElementById("image_view_url_link").href = target.dataset.url;

    document.getElementById("image_view_url_link").href = target.dataset.url;

  }

  }





function show_image_view_modal(event) {

  $(".result.result-images").click(function (event) {

    event.preventDefault();

    event.preventDefault();

    var target = event.target;

    var target = event.target;

    var view_url = target.src;

    if (target.tagName == "IMG") {

    if (target.tagName == "IMG") {

        target = target.parentElement;

        target = target.parentElement;

    }

    }
@@ -15,14 +16,15 @@ function show_image_view_modal(event) { 
    var modal = document.getElementById("image_view_modal");

    var modal = document.getElementById("image_view_modal");

    modal.classList.remove("hidden");

    modal.classList.remove("hidden");

    modal.style.top = window.scrollY + "px";

    modal.style.top = window.scrollY + "px";

  configure_image_view(target);

    configure_image_view(target, view_url);

    document.body.classList.add("lock");

    document.body.classList.add("lock");

}

  });





function close_image_view_modal() {

  $("#close_image_view_modal").click(function () {

    document.getElementById("image_view_modal").classList.add("hidden");

    document.getElementById("image_view_modal").classList.add("hidden");

    document.getElementById("image_view_image").src = "";

    document.getElementById("image_view_image").src = "";

    document.getElementById("image_view_file_link").href = "#";

    document.getElementById("image_view_file_link").href = "#";

    document.getElementById("image_view_url_link").href = "#";

    document.getElementById("image_view_url_link").href = "#";

    document.body.classList.remove("lock");

    document.body.classList.remove("lock");

}
 
  });

 No newline at end of file
 
});