Add privacy control options
This prevents the automatic loading of external content unless the user explicitly requests it.
This commit is contained in:
		
							parent
							
								
									57dfeda6b0
								
							
						
					
					
						commit
						ff07893501
					
				
							
								
								
									
										30
									
								
								index.php
									
									
									
									
									
								
							
							
						
						
									
										30
									
								
								index.php
									
									
									
									
									
								
							@ -9,7 +9,7 @@
 | 
			
		||||
		preg_match("/^[a-z0-9\-]*$/", $page, $matches); // SECURITY: Only lowercase a-z + numbers + -
 | 
			
		||||
		if (!$matches)
 | 
			
		||||
			$page=HOME_PAGE;
 | 
			
		||||
		$page=substr($page, 0, 12); // SECURITY: Max 12 chars
 | 
			
		||||
		$page=substr($page, 0, 16); // SECURITY: Max 16 chars
 | 
			
		||||
	}
 | 
			
		||||
	else {
 | 
			
		||||
		$page=HOME_PAGE;
 | 
			
		||||
@ -19,7 +19,33 @@
 | 
			
		||||
		$pageUrl="p/404.php";
 | 
			
		||||
		$pageTitle = "Error 404";
 | 
			
		||||
	}
 | 
			
		||||
	// --- $page and $pageUrl are now SAFE TO USE
 | 
			
		||||
 | 
			
		||||
	$optin = "";
 | 
			
		||||
	if (isset($_GET['optin-once'])) {
 | 
			
		||||
		$_COOKIE['opt-in'] = $_GET['optin-once'];
 | 
			
		||||
	}
 | 
			
		||||
	if (isset($_COOKIE['opt-in'])) {
 | 
			
		||||
		$opt = $_COOKIE['opt-in'];
 | 
			
		||||
		
 | 
			
		||||
		if (strlen($opt) <= 8) {
 | 
			
		||||
			preg_match("/^[a-z0-9\-]*$/", $opt, $matches);
 | 
			
		||||
			if ($matches) {
 | 
			
		||||
				if (isset($_GET['optout'])) {
 | 
			
		||||
					$opt = str_replace($_GET['optout'], '', $opt);
 | 
			
		||||
				}
 | 
			
		||||
				$optin = $opt;
 | 
			
		||||
			}
 | 
			
		||||
		}
 | 
			
		||||
	}
 | 
			
		||||
	if (isset($_GET['optin'])) {
 | 
			
		||||
		if ((strlen($_GET['optin']) == 1) && !opted_in($_GET['optin'])) {
 | 
			
		||||
			$optin .= $_GET['optin'];
 | 
			
		||||
		}
 | 
			
		||||
	}
 | 
			
		||||
	if (isset($_GET['optout']) || isset($_GET['optin'])) {
 | 
			
		||||
		setcookie('opt-in', $optin, strtotime("+1 year"));
 | 
			
		||||
	}
 | 
			
		||||
	// --- $page, $pageUrl and $optin are now SAFE TO USE
 | 
			
		||||
	
 | 
			
		||||
	$htmlHead = "";
 | 
			
		||||
	
 | 
			
		||||
 | 
			
		||||
							
								
								
									
										4
									
								
								p/privacy-controls.php
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										4
									
								
								p/privacy-controls.php
									
									
									
									
									
										Normal file
									
								
							@ -0,0 +1,4 @@
 | 
			
		||||
<?php
 | 
			
		||||
	if (!isset($CMS_ACTIVE)) exit();
 | 
			
		||||
	require_once "privacy-controls.php";
 | 
			
		||||
?>
 | 
			
		||||
							
								
								
									
										34
									
								
								privacy-controls.php
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										34
									
								
								privacy-controls.php
									
									
									
									
									
										Normal file
									
								
							@ -0,0 +1,34 @@
 | 
			
		||||
<?php
 | 
			
		||||
	if (!isset($CMS_ACTIVE)) exit();
 | 
			
		||||
	require_once "shared.php";
 | 
			
		||||
?>
 | 
			
		||||
 | 
			
		||||
<h1>Privacy Control Panel</h1>
 | 
			
		||||
<h2>What is this?</h2>
 | 
			
		||||
<p>
 | 
			
		||||
	This page allows you to configure your privacy preferences for the site. For more information about our privacy policy, please click <a href="/?p=contact#privacy">here</a>.
 | 
			
		||||
</p>
 | 
			
		||||
 | 
			
		||||
<h2>External content</h2>
 | 
			
		||||
<p>
 | 
			
		||||
	Here, you can allow the site to automatically load content from external sources. Please note that this means that the enabled sites are able to track your behavior, even when just visiting this site.
 | 
			
		||||
</p>
 | 
			
		||||
<p>
 | 
			
		||||
	These preferences are saved using a cookie with a validity period of one year. This means, after one year, you will have to refresh your consent.
 | 
			
		||||
</p>
 | 
			
		||||
 | 
			
		||||
<p>
 | 
			
		||||
	<table border=1>
 | 
			
		||||
		<tr><td>Content</td><td>Status</td><td>Change</td></tr>
 | 
			
		||||
		<tr>
 | 
			
		||||
			<td><strong>Automatically load embedded YouTube videos</strong></td>
 | 
			
		||||
			<?php
 | 
			
		||||
				if (opted_in('y')) {
 | 
			
		||||
					echo '<td style="color:orange;">Enabled</td><td><a href="/?p=privacy-controls&optout=y">opt out</a></td>';
 | 
			
		||||
				} else {
 | 
			
		||||
					echo '<td style="color:blue;">Disabled</td><td><a href="/?p=privacy-controls&optin=y">opt in</a></td>';
 | 
			
		||||
				}
 | 
			
		||||
			?>
 | 
			
		||||
		</tr>
 | 
			
		||||
	<table>
 | 
			
		||||
</p>
 | 
			
		||||
							
								
								
									
										39
									
								
								shared.php
									
									
									
									
									
								
							
							
						
						
									
										39
									
								
								shared.php
									
									
									
									
									
								
							@ -29,6 +29,21 @@
 | 
			
		||||
	$blogDirs = array("2017");
 | 
			
		||||
 | 
			
		||||
 | 
			
		||||
	function opted_in($identifier) {
 | 
			
		||||
		global $optin;
 | 
			
		||||
		return (stripos($optin, $identifier) !== false);
 | 
			
		||||
	}
 | 
			
		||||
 | 
			
		||||
	function append_param($p) {
 | 
			
		||||
		$url = $_SERVER['REQUEST_URI'];
 | 
			
		||||
		if (stripos($url, "?") !== false)
 | 
			
		||||
			$url .= "&";
 | 
			
		||||
		else
 | 
			
		||||
			$url .= "?";
 | 
			
		||||
		$url .= $p;
 | 
			
		||||
		return $url;
 | 
			
		||||
	}
 | 
			
		||||
	
 | 
			
		||||
	/*
 | 
			
		||||
	 * This function will include an image as figure.
 | 
			
		||||
	 * returns  : Number of the figure for later referencing.
 | 
			
		||||
@ -101,9 +116,29 @@
 | 
			
		||||
	$counters['video'] = 1;
 | 
			
		||||
	function includeVideo($url, $title="", $width=640) {
 | 
			
		||||
		global $counters;
 | 
			
		||||
		// TODO: HTML5 video
 | 
			
		||||
		
 | 
			
		||||
		$vlink = "NULL";
 | 
			
		||||
		preg_match("/.*youtube.com\/embed\/(.*)$/", $url, $matches);
 | 
			
		||||
		if (!$matches)
 | 
			
		||||
			preg_match("/.*youtube.com\/watch\?v=([^&]*).*$/", $url, $matches);
 | 
			
		||||
		if ($matches) {
 | 
			
		||||
			$youtube['embed'] = "https://www.youtube.com/embed/" . $matches[1];
 | 
			
		||||
			$youtube['link'] = "https://www.youtube.com/watch?v=" . $matches[1];
 | 
			
		||||
		}
 | 
			
		||||
		
 | 
			
		||||
		echo '<videoframe><div class="videoframe" style="width:' . $width . 'px;height:' . $width*9/16 . 'px">';
 | 
			
		||||
		echo '<iframe width="100%" height="100%" src="' . $url . '" frameborder="0" allowfullscreen></iframe>';
 | 
			
		||||
 | 
			
		||||
		if (isset($youtube)) {
 | 
			
		||||
			if (opted_in('y')) {
 | 
			
		||||
				echo '<iframe width="100%" height="100%" src="' . $url . '" frameborder="0" allowfullscreen></iframe>';
 | 
			
		||||
			} else {
 | 
			
		||||
				echo "<table border=0 style='height:100%;width:100%'><tr><td style='text-align:center;'>Embedded content has been disabled to protect your privacy.<br><br><br><strong><a href='" . append_param("optin-once=y") . "'>Click here to load the videos on this site once,</a></strong><br><br><strong><a href='/?p=privacy-controls'>or click here to allow them permanently,</a><br><br><a href=\"" . $youtube['link'] . "\">" . "or click here to watch the video on YouTube:<br>" . $youtube['link'] . "</a></strong><br><br><br>Please note that by enabling this video, data is transferred <br>to YouTube LLC, and is subject to their privacy policy.</td></tr></table>";
 | 
			
		||||
			}
 | 
			
		||||
		} else {
 | 
			
		||||
			// TODO: HTML5 video
 | 
			
		||||
			echo "SERVER ERROR: Video format not supported.";
 | 
			
		||||
		}
 | 
			
		||||
		
 | 
			
		||||
		echo '</div></videoframe>';
 | 
			
		||||
		if ($title != "") {
 | 
			
		||||
			echo '<vidcaption>Video ' . $counters['video'] . ". $title</vidcaption>";
 | 
			
		||||
 | 
			
		||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user