From cf51cbe2ae971fb79a5cba4caca62e8555bee584 Mon Sep 17 00:00:00 2001
From: echarp <manu@echarp.org>
Date: Thu, 4 May 2023 16:30:59 +0200
Subject: [PATCH] Remote scripts better managed, should not send private
 information

---
 bin/acoeur.conf                                    | 2 ++
 themes/acoeur/layouts/partials/head-additions.html | 9 +++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/bin/acoeur.conf b/bin/acoeur.conf
index 3810865..9298b2b 100644
--- a/bin/acoeur.conf
+++ b/bin/acoeur.conf
@@ -31,6 +31,8 @@
   </Directory>
 
   CustomLog /var/simpleWeb/log/apache/acoeur.log combined
+
+	Header always set Access-Control-Allow-Origin "cdnjs.cloudflare.com"
 </VirtualHost>
 
 <VirtualHost *:80>
diff --git a/themes/acoeur/layouts/partials/head-additions.html b/themes/acoeur/layouts/partials/head-additions.html
index 79d6966..7bb6153 100644
--- a/themes/acoeur/layouts/partials/head-additions.html
+++ b/themes/acoeur/layouts/partials/head-additions.html
@@ -1,13 +1,14 @@
 <script>const file = '{{ .File }}'</script>
 
 <script defer
-				src="https://unpkg.com/tinymce@6.3.1/tinymce.js"
-				referrerpolicy="origin"></script>
+				src="https://cdnjs.cloudflare.com/ajax/libs/tinymce/6.4.2/tinymce.min.js"
+				integrity="sha512-sWydClczl0KPyMWlARx1JaxJo2upoMYb9oh5IHwudGfICJ/8qaCyqhNTP5aa9Xx0aCRBwh71eZchgz0a4unoyQ==">
+</script>
 
 <script defer
 				src="https://cdn.jsdelivr.net/npm/easyqrcodejs@4.4.13/dist/easy.qrcode.min.js"
-				integrity="sha256-ysnj5Mp9adRzpXyhbGW2YTdUSpdapignH3Z57bMq6G8="
-				crossorigin="anonymous"></script>
+				integrity="sha256-ysnj5Mp9adRzpXyhbGW2YTdUSpdapignH3Z57bMq6G8=">
+</script>
 
 {{ with resources.Get "js/misc.js" | minify | fingerprint }}
 <script defer src="{{ .Permalink }}"></script>