Merge remote-tracking branch 'origin/main' into feature/farside

README.md

@@ -164,7 +164,7 @@ See the [available environment variables](#environment-variables) for additional
 
 ### F) Manual
 
-*Note: `Content-Security-Policy` headers are already sent by Whoogle -- you don't/shouldn't need to apply a CSP header yourself*
+*Note: `Content-Security-Policy` headers can be sent by Whoogle if you set `WHOOGLE_CSP`.*
 
 Clone the repo and run the following commands to start the app in a local-only environment:
 
@@ -330,6 +330,7 @@ There are a few optional environment variables available for customizing a Whoog
 | WHOOGLE_ALT_MD       | The medium.com alternative to use when site alternatives are enabled in the config.       |
 | WHOOGLE_AUTOCOMPLETE | Controls visibility of autocomplete/search suggestions. Default on -- use '0' to disable  |
 | WHOOGLE_MINIMAL      | Remove everything except basic result cards from all search queries.                      |
+| WHOOGLE_CSP          | Sets a default set of 'Content-Security-Policy' headers                                   |
 
 ### Config Environment Variables
 These environment variables allow setting default config values, but can be overwritten manually by using the home page config menu. These allow a shortcut for destroying/rebuilding an instance to the same config state every time.
@@ -496,23 +497,26 @@ A lot of the app currently piggybacks on Google's existing support for fetching
 
 ## Public Instances
 
-*Note: Use public instances at your own discretion. Maintainers of Whoogle do not personally validate the integrity of these instances, and popular public instances are more likely to be rate-limited or blocked.*
+*Note: Use public instances at your own discretion. The maintainers of Whoogle are only responsible for https://whoogle.fossho.st, and do not personally validate the integrity of any other instances. Popular public instances are more likely to be rate-limited or blocked.*
 
 | Website | Country | Language | Cloudflare |
 |-|-|-|-|
+| [https://whoogle.fossho.st](https://whoogle.fossho.st) | 🇺🇸 US | Multi-choice | |
 | [https://search.albony.xyz](https://search.albony.xyz/) | 🇮🇳 IN | Multi-choice |  |
 | [https://whoogle.sdf.org](https://whoogle.sdf.org) | 🇺🇸 US | Multi-choice |
-| [https://whoogle.kavin.rocks](https://whoogle.kavin.rocks) | 🇮🇳 IN | Unknown | ✅ |
 | [https://search.garudalinux.org](https://search.garudalinux.org) | 🇩🇪 DE | Multi-choice |  |
 | [https://whooglesearch.net](https://whooglesearch.net) | 🇩🇪 DE | Spanish |  |
-| [https://search.flawcra.cc](https://search.flawcra.cc) |🇩🇪 DE | Unknown | ✅ |
 | [https://search.exonip.de](https://search.exonip.de) | 🇳🇱 NL | Multi-choice |  |
-| [https://s.alefvanoon.xyz](https://s.alefvanoon.xyz) | 🇺🇸 US | English | ✅ |
+| [https://s.alefvanoon.xyz](https://s.alefvanoon.xyz) | 🇺🇸 US | Multi-choice | ✅ |
-| [https://search.flux.industries](https://search.flux.industries) | 🇩🇪 DE  | German | ✅ |
 | [https://www.whooglesearch.ml](https://www.whooglesearch.ml) | 🇺🇸 US | English | |
-| [http://whoogledq5f5wly5p4i2ohnvjwlihnlg4oajjum2oeddfwqdwupbuhqd.onion](http://whoogledq5f5wly5p4i2ohnvjwlihnlg4oajjum2oeddfwqdwupbuhqd.onion) | 🇮🇳 IN | Unknown |  |
 
-* A checkmark in the "Cloudflare" category here refers to the use of the reverse proxy, [Cloudflare](https://cloudflare). The checkmark will not be listed for a site which uses Cloudflare DNS but rather the proxying service which grants Cloudflare the ability to monitor traffic to the website.
+* A checkmark in the "Cloudflare" category here refers to the use of the reverse proxy, [Cloudflare](https://cloudflare.com). The checkmark will not be listed for a site which uses Cloudflare DNS but rather the proxying service which grants Cloudflare the ability to monitor traffic to the website.
+
+#### Onion Instances
+
+| Website | Country | Language |
+|-|-|-|
+| [http://whoglqjdkgt2an4tdepberwqz3hk7tjo4kqgdnuj77rt7nshw2xqhqad.onion](http://whoglqjdkgt2an4tdepberwqz3hk7tjo4kqgdnuj77rt7nshw2xqhqad.onion) | 🇺🇸 US |  Multi-choice 
 
 ## Screenshots
 #### Desktop

app/routes.py

@@ -145,9 +145,14 @@ def before_request_func():
 
 @app.after_request
 def after_request_func(resp):
-    resp.headers['Content-Security-Policy'] = app.config['CSP']
+    resp.headers['X-Content-Type-Options'] = 'nosniff'
-    if os.environ.get('HTTPS_ONLY', False):
+    resp.headers['X-Frame-Options'] = 'DENY'
-        resp.headers['Content-Security-Policy'] += 'upgrade-insecure-requests'
+
+    if os.getenv('WHOOGLE_CSP', False):
+        resp.headers['Content-Security-Policy'] = app.config['CSP']
+        if os.environ.get('HTTPS_ONLY', False):
+            resp.headers['Content-Security-Policy'] += \
+                'upgrade-insecure-requests'
 
     return resp
 

app/static/css/logo.css

@@ -12,6 +12,7 @@ a {
 
 @media (max-width: 1000px) {
     svg {
-        margin-top: .7em;
+        margin-top: .3em;
+        height: 70%;
     }
 }

app/static/css/main.css

@@ -144,6 +144,7 @@ footer {
 
 .whoogle-svg {
     width: 80%;
+    height: initial;
     display: block;
     margin: auto;
     padding-bottom: 10px;

app/templates/display.html

@@ -5,6 +5,7 @@
     <link rel="search" href="opensearch.xml" type="application/opensearchdescription+xml" title="Whoogle Search">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <meta name="referrer" content="no-referrer">
+    <link rel="stylesheet" href="{{ cb_url('logo.css') }}">
     <link rel="stylesheet" href="{{ cb_url('input.css') }}">
     <link rel="stylesheet" href="{{ cb_url('search.css') }}">
     <link rel="stylesheet" href="{{ cb_url('header.css') }}">

app/templates/index.html

@@ -21,6 +21,7 @@
     <script type="text/javascript" src="{{ cb_url('controller.js') }}"></script>
     <link rel="search" href="opensearch.xml" type="application/opensearchdescription+xml" title="Whoogle Search">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link rel="stylesheet" href="{{ cb_url('logo.css') }}">
     {% if config.theme %}
         {% if config.theme == 'system' %}
             <style>

app/templates/logo.html

@@ -1,4 +1,3 @@
-    <link rel="stylesheet" href="{{ cb_url('logo.css') }}">
     <svg id="Layer_1" class="whoogle-svg" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1028 254">
         <defs>
             <style>
@@ -17,4 +16,3 @@
         <path class="cls-1" d="M950.51,539.43c-.31,20.82-10.91,37.89-28,44.71-25.32,10.11-53.89-7-57.87-34.41-1.51-10.43-1.06-20.59,2.68-30.44,7.08-18.66,25.09-29.59,45-27.58,17.76,1.79,33.92,17.68,36.86,36.35C949.79,531.82,950.08,535.64,950.51,539.43Z" transform="translate(-446 -413)"></path>
         <path class="cls-1" d="M1099.71,539.39c-.39,22.14-11.74,39.51-30.16,45.6-25.8,8.54-53.64-10.27-55.87-37.67-.78-9.54-.55-18.93,3-28,7.25-18.72,24.95-29.59,45-27.62,17.2,1.68,33.14,16.78,36.57,34.84C1099,530.77,1099.23,535.1,1099.71,539.39Z" transform="translate(-446 -413)"></path>
     </svg>
-</a>

whoogle.template.env

@@ -19,6 +19,7 @@
 #WHOOGLE_PROXY_PASS=""
 #WHOOGLE_PROXY_TYPE=""
 #WHOOGLE_PROXY_LOC=""
+#WHOOGLE_CSP=1
 #HTTPS_ONLY=1
 
 # Restrict results to only those near a particular city