From 2878062adb5d104b3c870b5605a3c72b921cc4d1 Mon Sep 17 00:00:00 2001 From: Jonah Aragon Date: Sat, 12 Oct 2019 20:07:24 -0500 Subject: [PATCH 1/2] Remove CSP Report Endpoint --- nginx/010-headers.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nginx/010-headers.conf b/nginx/010-headers.conf index aa2a1de4..12f9c347 100644 --- a/nginx/010-headers.conf +++ b/nginx/010-headers.conf @@ -1,9 +1,9 @@ add_header X-Frame-Options DENY always; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options nosniff always; -add_header Content-Security-Policy "default-src 'none'; script-src 'self' https://stats.privacytools.io; style-src 'self'; img-src 'self' data: https://*.privacytools.io; object-src 'none'; frame-src https://stats.privacytools.io; font-src 'self'; base-uri 'none'; form-action 'self' https://search.privacytools.io; frame-ancestors 'none'; manifest-src 'self'; report-uri https://34f7a2cb34f91bc092b2e15f4e4bda78.report-uri.com/r/d/csp/enforce;" always; +add_header Content-Security-Policy "default-src 'none'; script-src 'self' https://stats.privacytools.io; style-src 'self'; img-src 'self' data: https://*.privacytools.io; object-src 'none'; frame-src https://stats.privacytools.io; font-src 'self'; base-uri 'none'; form-action 'self' https://search.privacytools.io; frame-ancestors 'none'; manifest-src 'self';" always; add_header Strict-Transport-Security "max-age=31557600; includeSubDomains; preload"; add_header 'Access-Control-Allow-Origin' '*'; add_header Alt-Svc 'h2="privacy2zbidut4m4jyj3ksdqidzkw3uoip2vhvhbvwxbqux5xy5obyd.onion:443"; ma=86400; persist=1'; -add_header Expect-CT 'max-age=0, report-uri="https://34f7a2cb34f91bc092b2e15f4e4bda78.report-uri.com/r/d/ct/reportOnly"'; +add_header Expect-CT 'max-age=0'; add_header Referrer-Policy "strict-origin"; -- 2.49.1 From 95dbe3d9af102c2a866187ae482901861c63db23 Mon Sep 17 00:00:00 2001 From: Dawid Potocki Date: Sun, 13 Oct 2019 15:18:04 +1300 Subject: [PATCH 2/2] Remove inline JavaScript --- _includes/footer.html | 2 +- _includes/head.html | 2 +- _includes/nav.html | 4 +-- _includes/scripts.html | 2 +- assets/css/style.scss | 1 + assets/js/main.js | 5 +++ pages/donate.html | 72 +++++++++++++++++++++--------------------- 7 files changed, 47 insertions(+), 41 deletions(-) diff --git a/_includes/footer.html b/_includes/footer.html index e390ba79..5c7cfa7b 100644 --- a/_includes/footer.html +++ b/_includes/footer.html @@ -44,7 +44,7 @@

Copy URL and Description

- + For easy copy and paste. Share this text snippet.

diff --git a/_includes/head.html b/_includes/head.html index dda47d7b..cce89706 100644 --- a/_includes/head.html +++ b/_includes/head.html @@ -43,6 +43,6 @@ - + diff --git a/_includes/nav.html b/_includes/nav.html index a58cb2a4..c59cecfd 100644 --- a/_includes/nav.html +++ b/_includes/nav.html @@ -145,9 +145,9 @@ Donate - + Theme - + diff --git a/_includes/scripts.html b/_includes/scripts.html index d236060a..d5e84077 100644 --- a/_includes/scripts.html +++ b/_includes/scripts.html @@ -2,7 +2,7 @@ - +