From e50b64d6d3d2eff4e263c31d7d30c1d3c9dcfefd Mon Sep 17 00:00:00 2001 From: zh-Wang286 Date: Thu, 13 Nov 2025 20:07:40 +0800 Subject: [PATCH 1/2] feat(privacy): add referrer meta tag to prevent information leakage Add to document head for enhanced privacy protection and hotlink bypass capability. This prevents browsers from sending HTTP Referer headers when loading external resources, particularly useful for: - Displaying images from platforms with referrer-based hotlink protection - Reducing information leakage to third-party servers - Enhancing user privacy Implements W3C Referrer Policy specification. --- _includes/head.html | 1 + 1 file changed, 1 insertion(+) diff --git a/_includes/head.html b/_includes/head.html index d0fcfd9b6f7..d803d241b94 100644 --- a/_includes/head.html +++ b/_includes/head.html @@ -1,5 +1,6 @@ + From b0154b136597b6ac37263d27d8e48c480db4a24f Mon Sep 17 00:00:00 2001 From: zh-Wang286 Date: Thu, 13 Nov 2025 20:08:47 +0800 Subject: [PATCH 2/2] feat(images): add referrerpolicy attribute for privacy protection Inject referrerpolicy="no-referrer" to image tags in: - refactor-content.html: post content images - sidebar.html: avatar image Prevents Referer header leakage and enables displaying images from platforms with referrer-based hotlink protection. --- _includes/refactor-content.html | 3 +++ _includes/sidebar.html | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/_includes/refactor-content.html b/_includes/refactor-content.html index 5b6de2f1ef8..c062945a2a3 100644 --- a/_includes/refactor-content.html +++ b/_includes/refactor-content.html @@ -161,6 +161,9 @@ {% assign _left = _left | append: ' loading="lazy"' %} {% endif %} + + {% assign _left = _left | append: ' referrerpolicy="no-referrer"' %} + {% if page.layout == 'home' %} {% assign _wrapper_start = '
' %} diff --git a/_includes/sidebar.html b/_includes/sidebar.html index 1cd0ee8a7cd..89a93fd8d90 100644 --- a/_includes/sidebar.html +++ b/_includes/sidebar.html @@ -7,7 +7,7 @@ {%- capture avatar_url -%} {% include media-url.html src=site.avatar %} {%- endcapture -%} - avatar + avatar {%- endif -%}