Enable no-referrer on img tags, enable strict-origin-when-cross-origin by default

Fixes #3889

Signed-off-by: Kevin Decherf <kevin@kdecherf.com>

diff --git a/src/Wallabag/CoreBundle/Helper/ContentProxy.php b/src/Wallabag/CoreBundle/Helper/ContentProxy.php
index 31953f12d3ef947babfdd1d860c63939d3643abc..bc257ffbc32ab1f8c468d3eb9cc170c67f3ffbc2 100644 (file)
--- a/src/Wallabag/CoreBundle/Helper/ContentProxy.php
+++ b/src/Wallabag/CoreBundle/Helper/ContentProxy.php
@@ -47,6 +47,7 @@ class ContentProxy
      */
     public function updateEntry(Entry $entry, $url, array $content = [], $disableContentUpdate = false)
     {
+        $this->graby->toggleImgNoReferrer(true);
         if (!empty($content['html'])) {
             $content['html'] = $this->graby->cleanupHtml($content['html'], $url);
         }

diff --git a/src/Wallabag/CoreBundle/Resources/views/base.html.twig b/src/Wallabag/CoreBundle/Resources/views/base.html.twig
index aa388bcbcbd3d5a2e062f8e1f5ab122822435589..c0eecd57499d0e6364cd47f951e3e9a8979f63af 100644 (file)
--- a/src/Wallabag/CoreBundle/Resources/views/base.html.twig
+++ b/src/Wallabag/CoreBundle/Resources/views/base.html.twig
@@ -8,6 +8,7 @@
         {% block head %}
             <meta name="viewport" content="initial-scale=1.0">
             <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+            <meta name="referrer" content="strict-origin-when-cross-origin">
             <!--[if IE]>
             <meta http-equiv="X-UA-Compatible" content="IE=10">
             <![endif]-->