Merge pull request ArchiveBox#799 from Inndy/dev

pirate · web-flow · commit 2427e6d3dc37 · 2021-07-19T10:16:52.000-04:00
Discard Referer header from iframe and link to original URL
diff --git a/archivebox/templates/core/snapshot.html b/archivebox/templates/core/snapshot.html
@@ -416,12 +416,14 @@ <h5>🗃&nbsp; Snapshot: <a href="/admin/core/snapshot/{{snapshot_id}}/change/">
                     {% endif %}
                     <div class="col-lg-2">
                         <div class="card">
-                            <iframe class="card-img-top" src="{{url}}" sandbox="allow-same-origin allow-top-navigation-by-user-activation allow-scripts allow-forms" scrolling="no" loading="lazy"></iframe>
+                            <iframe class="card-img-top" src="{{url}}" sandbox="allow-same-origin allow-top-navigation-by-user-activation allow-scripts allow-forms" scrolling="no" loading="lazy" referrerpolicy="no-referrer"></iframe>
                             <div class="card-body">
-                                <a href="{{url}}" title="Open in new tab..." target="_blank" rel="noopener">
+                                <a href="{{url}}" title="Open in new tab..." target="_blank" rel="noopener" referrerpolicy="no-referrer">
                                     <p class="card-text"><code>🌐 {{domain}}</code></p>
                                 </a>
-                                <a href="{{url}}" target="preview" id="original-btn"><h4 class="card-title">Original</h4></a>
+                                <a href="{{url}}" target="preview" id="original-btn" referrerpolicy="no-referrer">
+                                    <h4 class="card-title">Original</h4>
+                                </a>
                           </div>
                         </div>
                     </div>
