diff options
| -rw-r--r-- | config.toml | 17 | ||||
| -rw-r--r-- | templates/base.html | 6 | ||||
| -rw-r--r-- | templates/macros/head.html | 8 |
3 files changed, 24 insertions, 7 deletions
diff --git a/config.toml b/config.toml index 8aeb578..14f8700 100644 --- a/config.toml +++ b/config.toml @@ -37,7 +37,12 @@ readtime_string = "min" # read time indication eg "min": - 1 min "min read": - recent = true recent_items = 9 footer_credit = true -#footer_credit_override = '<p>Powered by <a href="https://www.getzola.org/">Zola</a> & <a href="https://github.com/Jieiku/abridge/">Abridge</a></p>' +#footer_credit_override = '<p>Powered by <a href="https://www.getzola.org/">Zola</a> & <a href="https://github.com/Jieiku/abridge/">Abridge</a></p>' # <i class="fa-solid fa-heart"></i> + +# Security Headers should preferably be set by your webserver (Nginx, Apache) https://observatory.mozilla.org +# Set this to true if you are unable to load your security headers with your webserver, this will load a couple of them as meta tags. +# There are many other security related headers most of which can only be set by the webserver method. +security_headers = false textlogo = '<font color="#f90">A</font>bridge' sitedesc = false # enables or disables the display of the site description below the logo. @@ -67,9 +72,13 @@ js_search_index ="search_index.en.js" js_search = "search.min.js" rss_atom_feed = "atom.xml" stylesheet = "abridge.css" # location and file to use for stylesheet: -# abridge.css - Automatic Dark/Light Theme based on browser/system preference. -# abridge-dark.css - Dark Theme -# abridge-light.css - Light Theme +# abridge.css - Orange Automatic Dark/Light Theme based on browser/system preference. +# abridge-dark.css - Orange Dark Theme +# abridge-light.css - Orange Light Theme +# abridge-blue.scss - Blue Automatic Night/Light Theme based on browser/system preference. +# abridge-bluelight.scss - Blue Light Theme +# abridge-bluenight.scss - Blue Dark Theme + # For externally loaded fonts make sure the include the FULL url including the http/https prefix fonts_load = false diff --git a/templates/base.html b/templates/base.html index 1b396cb..f056486 100644 --- a/templates/base.html +++ b/templates/base.html @@ -18,7 +18,7 @@ {%- endif %} {%- endblock seo %} {{- macros_head::favicons() }} - <meta name="referrer" content="no-referrer-when-downgrade"> + {{- macros_head::security() }} <meta name="HandheldFriendly" content="True"> <meta name="mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-capable" content="yes"> @@ -46,9 +46,9 @@ <input id="userinput" type="search" placeholder="Search" autocomplete="off"> <button type="submit" title="Search"> {%- if config.extra.fontawesome %} - <i class="svgs fa-solid fa-magnifying-glass"></i> + <i class="svgs fa-solid fa-magnifying-glass"></i> {%- else %} - <i class="svgs search"></i> + <i class="svgs search"></i> {%- endif %} </button> </div> diff --git a/templates/macros/head.html b/templates/macros/head.html index 0107b83..3ea785a 100644 --- a/templates/macros/head.html +++ b/templates/macros/head.html @@ -194,6 +194,14 @@ {#- Extra SEO END #} {%- endmacro %} +{%- macro security() %} + {%- if config.extra.security_headers %} + <meta name="referrer" content="strict-origin-when-cross-origin">{#- options: no-referrer, same-origin, strict-origin, strict-origin-when-cross-origin #} + <meta http-equiv="Content-Security-Policy" content="default-src 'none'; frame-ancestors 'none'; base-uri 'self'; manifest-src 'self'; connect-src 'self'; form-action 'self'; font-src 'self' cdn.jsdelivr.net fonts.gstatic.com; style-src 'self' cdn.jsdelivr.net fonts.googleapis.com; object-src 'self'; frame-src 'self' *.youtube.com; img-src 'self' data: cdn.cloudflare.com; script-src 'self' 'unsafe-inline' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com"> + {%- endif %} +{%- endmacro %} + + {%- macro math() %} {%- if config.extra.katex_enabled %} <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.15.1/dist/katex.min.css" integrity="sha384-R4558gYOUz8mP9YWpZJjofhk+zx0AS11p36HnD2ZKj/6JR5z27gSSULCNHIRReVs" crossorigin="anonymous"> |