From e6fd34bdda5d067a9e74714aaae10c89ed998a46 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sat, 13 Aug 2016 17:49:31 +0200
Subject: CSRF token, update HTTP Referrer policy to same-origin

https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
---
 app/layout/layout.phtml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app/layout/layout.phtml')

diff --git a/app/layout/layout.phtml b/app/layout/layout.phtml
index 2aeba40a9..189d93fbe 100644
--- a/app/layout/layout.phtml
+++ b/app/layout/layout.phtml
@@ -42,7 +42,7 @@
 ?>
 		<link rel="alternate" type="application/rss+xml" title="<?php echo $this->rss_title; ?>" href="<?php echo Minz_Url::display($url_rss); ?>" />
 <?php } if (!FreshRSS_Context::$system_conf->allow_referrer) { ?>
-		<meta name="referrer" content="origin" />
+		<meta name="referrer" content="never" />
 <?php } if (FreshRSS_Context::$system_conf->allow_robots) { ?>
 		<meta name="description" content="<?php echo htmlspecialchars(FreshRSS_Context::$name . ' | ' . FreshRSS_Context::$description, ENT_COMPAT, 'UTF-8'); ?>" />
 <?php } else { ?>
-- 
cgit v1.2.3