From ff07893501cb63c5e92d93375742bd39ed9b849d Mon Sep 17 00:00:00 2001 From: Markus Koch Date: Wed, 30 May 2018 19:24:30 +0200 Subject: [PATCH] Add privacy control options This prevents the automatic loading of external content unless the user explicitly requests it. --- index.php | 30 ++++++++++++++++++++++++++++-- p/privacy-controls.php | 4 ++++ privacy-controls.php | 34 ++++++++++++++++++++++++++++++++++ shared.php | 39 +++++++++++++++++++++++++++++++++++++-- 4 files changed, 103 insertions(+), 4 deletions(-) create mode 100644 p/privacy-controls.php create mode 100644 privacy-controls.php diff --git a/index.php b/index.php index 4607791..24bd391 100644 --- a/index.php +++ b/index.php @@ -9,7 +9,7 @@ preg_match("/^[a-z0-9\-]*$/", $page, $matches); // SECURITY: Only lowercase a-z + numbers + - if (!$matches) $page=HOME_PAGE; - $page=substr($page, 0, 12); // SECURITY: Max 12 chars + $page=substr($page, 0, 16); // SECURITY: Max 16 chars } else { $page=HOME_PAGE; @@ -19,7 +19,33 @@ $pageUrl="p/404.php"; $pageTitle = "Error 404"; } - // --- $page and $pageUrl are now SAFE TO USE + + $optin = ""; + if (isset($_GET['optin-once'])) { + $_COOKIE['opt-in'] = $_GET['optin-once']; + } + if (isset($_COOKIE['opt-in'])) { + $opt = $_COOKIE['opt-in']; + + if (strlen($opt) <= 8) { + preg_match("/^[a-z0-9\-]*$/", $opt, $matches); + if ($matches) { + if (isset($_GET['optout'])) { + $opt = str_replace($_GET['optout'], '', $opt); + } + $optin = $opt; + } + } + } + if (isset($_GET['optin'])) { + if ((strlen($_GET['optin']) == 1) && !opted_in($_GET['optin'])) { + $optin .= $_GET['optin']; + } + } + if (isset($_GET['optout']) || isset($_GET['optin'])) { + setcookie('opt-in', $optin, strtotime("+1 year")); + } + // --- $page, $pageUrl and $optin are now SAFE TO USE $htmlHead = ""; diff --git a/p/privacy-controls.php b/p/privacy-controls.php new file mode 100644 index 0000000..eeaec99 --- /dev/null +++ b/p/privacy-controls.php @@ -0,0 +1,4 @@ + diff --git a/privacy-controls.php b/privacy-controls.php new file mode 100644 index 0000000..18f25bd --- /dev/null +++ b/privacy-controls.php @@ -0,0 +1,34 @@ + + +

Privacy Control Panel

+

What is this?

+

+ This page allows you to configure your privacy preferences for the site. For more information about our privacy policy, please click here. +

+ +

External content

+

+ Here, you can allow the site to automatically load content from external sources. Please note that this means that the enabled sites are able to track your behavior, even when just visiting this site. +

+

+ These preferences are saved using a cookie with a validity period of one year. This means, after one year, you will have to refresh your consent. +

+ +

+ + + + + Enabled'; + } else { + echo ''; + } + ?> + +
ContentStatusChange
Automatically load embedded YouTube videosopt outDisabledopt in
+

diff --git a/shared.php b/shared.php index 9c2a5ad..4ea386f 100644 --- a/shared.php +++ b/shared.php @@ -29,6 +29,21 @@ $blogDirs = array("2017"); + function opted_in($identifier) { + global $optin; + return (stripos($optin, $identifier) !== false); + } + + function append_param($p) { + $url = $_SERVER['REQUEST_URI']; + if (stripos($url, "?") !== false) + $url .= "&"; + else + $url .= "?"; + $url .= $p; + return $url; + } + /* * This function will include an image as figure. * returns : Number of the figure for later referencing. @@ -101,9 +116,29 @@ $counters['video'] = 1; function includeVideo($url, $title="", $width=640) { global $counters; - // TODO: HTML5 video + + $vlink = "NULL"; + preg_match("/.*youtube.com\/embed\/(.*)$/", $url, $matches); + if (!$matches) + preg_match("/.*youtube.com\/watch\?v=([^&]*).*$/", $url, $matches); + if ($matches) { + $youtube['embed'] = "https://www.youtube.com/embed/" . $matches[1]; + $youtube['link'] = "https://www.youtube.com/watch?v=" . $matches[1]; + } + echo '
'; - echo ''; + + if (isset($youtube)) { + if (opted_in('y')) { + echo ''; + } else { + echo "
Embedded content has been disabled to protect your privacy.


Click here to load the videos on this site once,

or click here to allow them permanently,

" . "or click here to watch the video on YouTube:
" . $youtube['link'] . "



Please note that by enabling this video, data is transferred
to YouTube LLC, and is subject to their privacy policy.
"; + } + } else { + // TODO: HTML5 video + echo "SERVER ERROR: Video format not supported."; + } + echo ''; if ($title != "") { echo 'Video ' . $counters['video'] . ". $title";