Merge pull request 'csp corrections for matomo' (#19) from add-nonce into main

Reviewed-on: #19

config.toml

@@ -212,10 +212,10 @@ copyright = "© $CURRENT_YEAR $AUTHOR $SEPARATOR Unless otherwise noted, the con
 # Default config, allows for https remote images and embedding YouTube and Vimeo content.
 # This configuration (along with the right webserver settings) gets an A+ in Mozilla's Observatory: https://observatory.mozilla.org
 allowed_domains = [
-    { directive = "connect-src", domains = ["'self'"] },
+    { directive = "connect-src", domains = ["'self'", "http://wisdom.softinio.com/matomo.php"] },
     { directive = "font-src", domains = ["'self'", "data:"] },
     { directive = "img-src", domains = ["'self'", "https://*", "data:"] },
-    { directive = "script-src", domains = ["'self'", "https://comments.softinio.com/js/embed.min.js", "https://static.cloudflareinsights.com" ] },
+    { directive = "script-src", domains = ["'self'", "https://comments.softinio.com/js/embed.min.js", "https://static.cloudflareinsights.com", "http://wisdom.softinio.com/matomo.js","'sha256-f5+1KXLs1mZ8y68NQwBoE7PzEG3F0whGW7NzS9tC4rg='"] },
     { directive = "style-src", domains = ["'self'"] },
     { directive = "frame-src", domains = ["player.vimeo.com", "https://www.youtube-nocookie.com", "https://watch.softinio.com", "https://notes.softinio.com/embed"] },
 ]

templates/partials/analytics.html

@@ -1,15 +0,0 @@
-<!-- Matomo -->
-<script>
-	var _paq = window._paq = window._paq || [];
-	/* tracker methods like "setCustomDimension" should be called before "trackPageView" */
-	_paq.push(['trackPageView']);
-	_paq.push(['enableLinkTracking']);
-	(function () {
-		var u = "//wisdom.softinio.com/";
-		_paq.push(['setTrackerUrl', u + 'matomo.php']);
-		_paq.push(['setSiteId', '1']);
-		var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0];
-		g.async = true; g.src = u + 'matomo.js'; s.parentNode.insertBefore(g, s);
-	})();
-</script>
-<!-- End Matomo Code -->

templates/partials/custom_header.html

@@ -1,3 +1,19 @@
+<!-- Matomo -->
+<script>
+	var _paq = window._paq = window._paq || [];
+	/* tracker methods like "setCustomDimension" should be called before "trackPageView" */
+	_paq.push(['trackPageView']);
+	_paq.push(['enableLinkTracking']);
+	(function () {
+		var u = "//wisdom.softinio.com/";
+		_paq.push(['setTrackerUrl', u + 'matomo.php']);
+		_paq.push(['setSiteId', '1']);
+		var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0];
+		g.async = true; g.src = u + 'matomo.js'; s.parentNode.insertBefore(g, s);
+	})();
+</script>
+<!-- End Matomo Code -->
+
 {% if config.extra.favicon180 %}
 <link rel="apple-touch-icon" type="image/png" sizes="180x180" href="{{ get_url(path=config.extra.favicon180) }}" />
 {% endif %}
@@ -30,5 +46,3 @@
 <meta name="twitter:site" content="@{{ config.extra.twitter_meta }}" />
 <meta name="twitter:creator" content="@{{ config.extra.twitter_meta }}" />
 {%- endif %}
-
-