tdiary 5.5.1 → 5.6.1

data/js/image.js

@@ -18,20 +18,57 @@ $(function(){
 		$(this).css('cursor', 'default');
 	})
 	.on('click', '.image-img', function(){
-		var idx = this.id.replace('image-index-', '');
-		var w = $('#image-info-' + idx + ' .image-width').text();
-		var h = $('#image-info-' + idx + ' .image-height').text();
-		$('#body').insertAtCaret($.makePluginTag('image', function(){
-			return [idx, "'" + $tDiary.plugin.image.alt + "'", 'nil', '[' + w + ',' + h + ']']
-		}));
+		$('#body').insertAtCaret(imageTag(this));
 	});
-	
+
+	var imageTag = function(img, context){
+		var idx = img.id.replace('image-index-', '');
+		var w = $('#image-info-' + idx + ' .image-width', context).text();
+		var h = $('#image-info-' + idx + ' .image-height', context).text();
+		return $.makePluginTag('image', function(){
+			return [idx, "'" + $tDiary.plugin.image.alt + "'", 'nil', '[' + w + ',' + h + ']']
+		});
+	};
+
+	var imageFiles = function(files){
+		return $.grep(files, function(file){
+			return /^image\//.test(file.type);
+		});
+	};
+
+	var shrink = function(file){
+		if(!window.createImageBitmap || file.type == 'image/gif'){
+			return Promise.resolve(file);
+		}
+		return createImageBitmap(file, {imageOrientation: 'from-image'}).then(function(bitmap){
+			var scale = Math.min(1, $tDiary.plugin.image.resize / Math.max(bitmap.width, bitmap.height));
+			var type = file.type == 'image/png' && scale == 1 ? 'image/png' : 'image/jpeg';
+			var canvas = document.createElement('canvas');
+			canvas.width = Math.max(1, Math.round(bitmap.width * scale));
+			canvas.height = Math.max(1, Math.round(bitmap.height * scale));
+			var context = canvas.getContext('2d');
+			if(type == 'image/jpeg'){
+				context.fillStyle = '#fff';
+				context.fillRect(0, 0, canvas.width, canvas.height);
+			}
+			context.drawImage(bitmap, 0, 0, canvas.width, canvas.height);
+			bitmap.close();
+			return new Promise(function(resolve){
+				canvas.toBlob(function(blob){
+					resolve(blob || file);
+				}, type, 0.85);
+			});
+		}).catch(function(){
+			return file;
+		});
+	};
+
 	var ImagePlugin = function(url){
 		this.url =url;
 	};
 	ImagePlugin.prototype = {
-		upload: function(formData, callback){
-			$.ajax({
+		upload: function(formData){
+			return $.ajax({
 				url: this.url,
 				type: 'post',
 				data: formData,
@@ -41,9 +78,6 @@ $(function(){
 					$('#plugin-image-addimage input[type="submit"]').attr('disabled', 'disabled');
 					$('#plugin-image-uploading').show();
 				},
-				success: function(data){
-					callback(data);
-				},
 				complete: function(){
 					$('#plugin-image-addimage input[type="submit"]').removeAttr('disabled');
 					$('#plugin-image-uploading').hide();
@@ -74,40 +108,96 @@ $(function(){
 		}
 		e.preventDefault();
 		
-		uploadFiles(this.plugin_image_file.files);
+		uploadFiles($.makeArray(this.plugin_image_file.files));
 		this.reset();
 		return false;
 	});
 	
+	var replaceMarker = function(marker, text){
+		var body = $('#body').get(0);
+		var start = body.value.indexOf(marker);
+		if(start < 0){
+			if(text){
+				$('#body').insertAtCaret(text);
+			}
+			return;
+		}
+		var end = start + marker.length;
+		body.setRangeText(text, start, end, body.selectionStart == end ? 'end' : 'preserve');
+	};
+
+	var uploads = 0;
+	var uploading = Promise.resolve();
 	var uploadFiles = function(files) {
-		var formData = new FormData();
-		formData.append('plugin', 'image');
-		$.each($('#plugin-image-addimage input[type="hidden"]'), function(){
-			formData.append($(this).attr('name'), $(this).val());
-		});
-		$.each(files, function(i, file){
-			formData.append('plugin_image_file', file);
-		});
+		if(!files.length){
+			return false;
+		}
+		var marker = '[Uploading image ' + (++uploads) + '...]';
+		$('#body').insertAtCaret(marker);
+		uploading = uploading.then(function(){
+			return files.reduce(function(shrunk, file){
+				return shrunk.then(function(images){
+					return shrink(file).then(function(image){
+						return images.concat([image]);
+					});
+				});
+			}, Promise.resolve([]));
+		}).then(function(images){
+			var formData = new FormData();
+			formData.append('plugin', 'image');
+			formData.append('plugin_image_addimage', 'true');
+			formData.append('date', $tDiary.plugin.image.date);
+			$('form.update [name=csrf_protection_key]').first().each(function(){
+				formData.append(this.name, this.value);
+			});
+			$.each(images, function(i, image){
+				formData.append('plugin_image_file', image, image.name || (image.type == 'image/png' ? 'image.png' : 'image.jpg'));
+			});
 
-		var imagePlugin = new ImagePlugin($(this).attr('action'));
-		imagePlugin.upload(formData, function(result){
+			var imagePlugin = new ImagePlugin($('form.update').attr('action'));
+			return imagePlugin.upload(formData);
+		}).then(function(result){
+			var list = $('#plugin-image-delimage', result).parents('div.form');
+			var tags = $.map(list.find('.image-img[data-added]'), function(img){
+				return imageTag(img, list);
+			});
+			if(!tags.length){
+				throw new Error('no image was saved');
+			}
 			$('#plugin-image-delimage').parents('div.form').remove();
 			$('<div>')
 				.attr({
 					'class': 'form'
 				})
-				.append($('#plugin-image-delimage', result).parents('div.form').html())
+				.append(list.html())
 				.insertBefore('#plugin-image-addimage');
 			var timestamp = new Date().getTime();
 			$.each($('#plugin-image-delimage img'), function(){
 				$(this).attr('src', $(this).attr('src') + '?' + timestamp);
 			});
+			replaceMarker(marker, tags.join("\n"));
+		}).catch(function(error){
+			replaceMarker(marker, '');
+			console.error(error);
+			alert($tDiary.plugin.image.failed);
 		});
 		return false;
 	};
 
-	$('#plugin-image-delimage')
-	.on('submit', function(e){
+	$('#body').on('paste', function(e){
+		var clipboard = e.originalEvent.clipboardData;
+		if(!clipboard || $.inArray('text/plain', clipboard.types) >= 0){
+			return;
+		}
+		var files = imageFiles(clipboard.files);
+		if(files.length){
+			e.preventDefault();
+			this.setRangeText('', this.selectionStart, this.selectionEnd, 'end');
+			uploadFiles(files);
+		}
+	});
+
+	$(document).on('submit', '#plugin-image-delimage', function(e){
 		e.preventDefault();
 		
 		var ids = $.map($('#image-table input[name="plugin_image_id"]:checked'), function(i){
@@ -147,14 +237,23 @@ $(function(){
 				$('#plugin_image_dnd').hide();
 				$(this).css('border', 'dashed 3px #CCC');
 				$('#plugin-image-addimage form').show();
-				var files = e.originalEvent.dataTransfer.files;
-				uploadFiles(files);
+				uploadFiles($.makeArray(e.originalEvent.dataTransfer.files));
 				return false;
 			})
 			.text($tDiary.plugin.image.drop_here)
 			.hide()
 			.appendTo('#plugin-image-addimage');
 
+		$('#body').on('drop', function(e){
+			var files = imageFiles(e.originalEvent.dataTransfer.files);
+			if(files.length){
+				e.preventDefault();
+				$('#plugin_image_dnd').hide();
+				$('#plugin-image-addimage form').show();
+				uploadFiles(files);
+			}
+		});
+
 		var dnd_timer = false;
 		$('body')
 			.on('dragenter', function() {

data/lib/tdiary/admin.rb

@@ -8,7 +8,7 @@ module TDiary
 			super
 
 			begin
-				@date = Time::local( @cgi.params['year'][0].to_i, @cgi.params['month'][0].to_i, @cgi.params['day'][0].to_i )
+				@date = Time::local( @request.param('year').to_i, @request.param('month').to_i, @request.param('day').to_i )
 			rescue ArgumentError, NameError
 				raise TDiaryError, 'bad date'
 			end
@@ -71,12 +71,12 @@ module TDiary
 		def initialize( cgi, rhtm, conf )
 			super
 
-			@title = @cgi.params['title'][0]
-			@body = @cgi.params['body'][0]
+			@title = @request.param('title')
+			@body = @request.param('body')
 			@title = @conf.to_native( @title )
 			@body = @conf.to_native( @body )
-			@old_date = @cgi.params['old'][0]
-			@hide = @cgi.params['hide'][0] == 'true' ? true : false
+			@old_date = @request.param('old')
+			@hide = @request.param('hide') == 'true' ? true : false
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -107,13 +107,11 @@ module TDiary
 	#
 	class TDiaryUpdate < TDiaryAdmin
 		def initialize( request, rhtml, conf )
-			# @cgi is not derived yet before super; go through the facade here
-			params = request.cgi_compat.params
-			@title = params['title'][0]
-			@body = params['body'][0]
+			@title = request.param('title')
+			@body = request.param('body')
 			@title = conf.to_native( @title )
 			@body = conf.to_native( @body )
-			@hide = params['hide'][0] == 'true' ? true : false
+			@hide = request.param('hide') == 'true' ? true : false
 			super
 		end
 
@@ -140,7 +138,7 @@ module TDiary
 				@date = newdate
 			end
 
-			@author = @conf.multi_user ? @cgi.remote_user : nil
+			@author = @conf.multi_user ? @request.remote_user : nil
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -166,7 +164,7 @@ module TDiary
 	class TDiaryReplace < TDiaryUpdate
 		def initialize( cgi, rhtm, conf )
 			super
-			old_date = @cgi.params['old'][0]
+			old_date = @request.param('old')
 
 			@io.transaction( @date ) do |diaries|
 				@diaries = diaries
@@ -203,7 +201,7 @@ module TDiary
 				if @diary then
 					idx = 0
 					@diary.each_comment do |com|
-						com.show = @cgi.params[(idx += 1).to_s][0] == 'true' ? true : false;
+						com.show = @request.param((idx += 1).to_s) == 'true' ? true : false;
 					end
 					self << @diary
 					@io.clear_cache( /(latest|#{@date.strftime( '%Y%m' )})/ )

data/lib/tdiary/application.rb

@@ -15,6 +15,7 @@ module TDiary
 			base_dir ||= self.base_dir
 
 			@app = ::Rack::Builder.app do
+				use TDiary::Rack::ErrorHandler
 				map base_dir do
 					map '/' do
 						use TDiary::Rack::HtmlAnchor
@@ -39,13 +40,7 @@ module TDiary
 		end
 
 		def call( env )
-			begin
-				@app.call( env )
-			rescue Exception => e
-				body = ["#{e.class}: #{e}\n"]
-				body << e.backtrace.join("\n")
-				[500, {'content-type' => 'text/plain'}, body]
-			end
+			@app.call( env )
 		end
 
 		def assets_paths

data/lib/tdiary/author_only_base.rb

@@ -6,6 +6,68 @@ module TDiary
 	class TDiaryAuthorOnlyBase < TDiaryBase
 		def csrf_protection_get_is_okay; false; end
 
+		# pure decision helpers for csrf_check, class methods so unit specs
+		# can exercise them without building a full TDiaryBase
+
+		# referer must be non-empty with its query string stripped; it is
+		# allowed when it names the update page itself or matches the
+		# admin-configured regexp
+		def self.csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+			return true if config_uri == URI.parse( referer )
+			allowed_referer_regexp != '' && Regexp.new( allowed_referer_regexp ).match?( referer )
+		end
+
+		# normalize an absolute http(s) URL to its origin serialization
+		# (lowercase scheme://host, default port omitted); nil when the
+		# input has no usable origin
+		def self.csrf_origin_of( url )
+			uri = URI.parse( url.to_s )
+			return nil unless uri.kind_of?( URI::HTTP ) and uri.host
+			port = uri.port == uri.default_port ? '' : ":#{uri.port}"
+			"#{uri.scheme.downcase}://#{uri.host.downcase}#{port}"
+		rescue URI::InvalidURIError
+			nil
+		end
+
+		# classify the request provenance from browser fetch metadata:
+		# :same_origin / :cross_site / :unknown (no usable signal, e.g.
+		# non-browser clients or a user-initiated navigation)
+		def self.csrf_fetch_verdict( origin, sec_fetch_site, allowed_origins )
+			if origin and !origin.empty?
+				# 'null' (sandboxed or opaque initiators) never matches
+				return allowed_origins.include?( origin.downcase ) ? :same_origin : :cross_site
+			end
+			case sec_fetch_site
+			when 'same-origin'
+				:same_origin
+			when 'same-site', 'cross-site'
+				:cross_site
+			else
+				:unknown
+			end
+		end
+
+		# main csrf decision: Origin / Sec-Fetch-Site first, the legacy
+		# Referer check only as a fallback when neither header gives a
+		# usable signal. A cross-site verdict can still be allowed by an
+		# explicit Referer allowance (the update page itself or the
+		# admin-configured regexp), but not by the empty-referer tolerance
+		# of check_referer=false.
+		def self.csrf_provenance_ok?( origin, sec_fetch_site, referer, allowed_origins, config_uri, allowed_referer_regexp, check_referer )
+			case csrf_fetch_verdict( origin, sec_fetch_site, allowed_origins )
+			when :same_origin
+				true
+			when :cross_site
+				referer != '' && csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+			else
+				if referer == ''
+					!check_referer
+				else
+					csrf_referer_allowed?( referer, config_uri, allowed_referer_regexp )
+				end
+			end
+		end
+
 		def initialize( cgi, rhtml, conf )
 			super
 			csrf_check( @request, conf )
@@ -43,8 +105,7 @@ module TDiary
 
 			referer_is_empty = referer == ''
 			referer_uri = URI.parse(referer) if !referer_is_empty
-			referer_is_config = !referer_is_empty && config_uri == referer_uri
-			referer_is_config ||= Regexp.new(updaterb_regexp) =~ referer if !referer_is_empty && updaterb_regexp != ''
+			referer_is_config = !referer_is_empty && self.class.csrf_referer_allowed?(referer, config_uri, updaterb_regexp)
 			is_post = request.post?
 
 			given_key = request.params['csrf_protection_key']
@@ -53,12 +114,18 @@ module TDiary
 			is_key_ok = masterkey != '' && given_key == masterkey
 
 			keycheck_ok = !check_key || is_key_ok
-			referercheck_ok = referer_is_config || (!check_referer && referer_is_empty)
+
+			origin = request.env['HTTP_ORIGIN']
+			sec_fetch_site = request.env['HTTP_SEC_FETCH_SITE']
+			allowed_origins = [base_uri, config_uri, request.base_url].map {|url|
+				self.class.csrf_origin_of( url )
+			}.compact.uniq
+			provenance_ok = self.class.csrf_provenance_ok?( origin, sec_fetch_site, referer, allowed_origins, config_uri, updaterb_regexp, check_referer )
 
 			if csrf_protection_get_is_okay then
 				return if is_post || given_key == nil
 			else
-				return if keycheck_ok && referercheck_ok
+				return if keycheck_ok && provenance_ok
 			end
 
 			raise Exception.new(<<"EOS")
@@ -69,6 +136,8 @@ Security Error: Possible Cross-site Request Forgery (CSRF)
                 - Mode is #{ self.mode || 'unknown' }
                     - GET is #{ csrf_protection_get_is_okay ? '' : 'not '}allowed
                 - Request Method is #{ is_post ? 'POST' : 'not POST' }
+                - Origin is #{ origin ? h(origin) : 'nothing' }
+                - Sec-Fetch-Site is #{ sec_fetch_site ? h(sec_fetch_site) : 'nothing' }
                 - Referer is #{ referer_is_empty ? 'empty' : referer_is_config ? 'config' : 'another page' }
                     - Given referer:       #{h referer_uri.to_s}
                     - Expected base URI:   #{h base_uri.to_s}
@@ -91,11 +160,11 @@ EOS
 		def initialize( cgi, rhtm, conf )
 			super
 
-			if @cgi.valid?( 'date' ) then
-				if @cgi.params['date'][0].kind_of?( String ) then
-					date = @cgi.params['date'][0]
+			if @request.valid?( 'date' ) then
+				if @request.param('date').kind_of?( String ) then
+					date = @request.param('date')
 				else
-					date = @cgi.params['date'][0].read
+					date = @request.param('date').read
 				end
 				@date = Time::local( *date.scan( /(\d{4})(\d\d)(\d\d)/ )[0] )
 			else
@@ -125,7 +194,7 @@ EOS
 
 		def initialize( cgi, rhtml, conf )
 			super
-			@key = @cgi.params['conf'][0] || ''
+			@key = @request.param('conf') || ''
 		end
 	end
 

data/lib/tdiary/base.rb

@@ -203,7 +203,7 @@ module TDiary
 		def initialize(cgi, rhtml, conf)
 			super
 
-			tdiary = tdiary_class(@cgi.params['date'][0] || '').new(@request, '', conf)
+			tdiary = tdiary_class(@request.param('date') || '').new(@request, '', conf)
 			@date = tdiary.date
 			@diaries = tdiary.diaries
 			@last_modified = Time.now
@@ -221,7 +221,7 @@ module TDiary
 
 		def plugin_name
 			# plugin name MUST contain only words ([a-zA-Z0-9_])
-			@plugin_name ||= (@cgi.params['plugin'][0] || '').match(/^(\w+)$/).to_a[1]
+			@plugin_name ||= (@request.param('plugin') || '').match(/^(\w+)$/).to_a[1]
 			raise TDiary::PermissionError.new('invalid plugin name') unless @plugin_name
 			@plugin_name
 		end

data/lib/tdiary/cgi_adapter.rb

@@ -1,4 +1,5 @@
 require 'stringio'
+require 'tdiary/rack/error_handler'
 
 module TDiary
 	#
@@ -23,9 +24,10 @@ module TDiary
 
 			def run( request, dispatcher )
 				env = build_env( request.env.to_hash, request.in, request.err )
-				write_response( request.out, *dispatcher.call( env ) )
+				app = TDiary::Rack::ErrorHandler.new( dispatcher )
+				write_response( request.out, *app.call( env ) )
 			rescue Exception => e
-				write_error( request.out, e )
+				write_error( request, e )
 			ensure
 				request.finish
 			end
@@ -69,9 +71,9 @@ module TDiary
 				end
 			end
 
-			def write_error( out, e )
-				body = "<h1>500 Internal Server Error</h1>\n<pre>#{CGI::escapeHTML( "#{e} (#{e.class})\n\n#{e.backtrace.join( "\n" )}" )}</pre>\n"
-				write_response( out, 500, { 'content-type' => 'text/html' }, [body] )
+			def write_error( request, e )
+				TDiary::Rack::ErrorHandler.report( request.err, e )
+				write_response( request.out, 500, { 'content-type' => 'text/plain' }, ["500 Internal Server Error\n"] )
 			end
 		end
 	end

data/lib/tdiary/cgi_compat.rb

@@ -16,37 +16,51 @@ module TDiary
 			# built eagerly so that a clone (Object#clone copies instance
 			# variables by reference) shares the same params Hash, like a
 			# cloned CGI instance does. Plugins may still rely on this.
-			@params = build_params
+			@params = request.cgi_params
 		end
 
 		attr_reader :params
 
-		def valid?( param, idx = 0 )
-			params[param] and params[param][idx] and params[param][idx].length > 0
+		# the env of the wrapped request, for the stateless RequestExtension
+		# readers (remote_addr, https?, tdiary_base_url, ...)
+		def env
+			@request.env
+		end
+
+		# the stateful RequestExtension readers delegate to the wrapped
+		# request, so core code reading the request directly sees the same
+		# params Hash and the same hidden-referer state as plugins do
+		# through this facade
+		def cgi_params
+			@request.cgi_params
+		end
+
+		def cgi_cookies
+			@request.cgi_cookies
+		end
+
+		def hide_referer!
+			@request.hide_referer!
+		end
+
+		def referer
+			@request.referer
 		end
 
 		def cookies
 			# CGI::Cookie keeps the multi-value cookie behaviour (00default.rb
 			# reads name and mail from the two values of the tdiary cookie)
-			@cookies ||= CGI::Cookie.parse( env_table['HTTP_COOKIE'] )
+			cgi_cookies
 		end
 
 		def env_table
 			@request.env
 		end
 
-		def referer
-			env_table['HTTP_REFERER']
-		end
-
 		def user_agent
 			env_table['HTTP_USER_AGENT']
 		end
 
-		def remote_addr
-			env_table['REMOTE_ADDR']
-		end
-
 		def request_method
 			env_table['REQUEST_METHOD']
 		end
@@ -55,10 +69,6 @@ module TDiary
 			env_table['SCRIPT_NAME']
 		end
 
-		def remote_user
-			env_table['REMOTE_USER']
-		end
-
 		def auth_type
 			env_table['AUTH_TYPE']
 		end
@@ -77,12 +87,6 @@ module TDiary
 
 		# the URL helpers below come from the CGI patches that used to live
 		# in core_ext.rb
-		def https?
-			return true if env_table['HTTP_X_FORWARDED_PROTO'] == 'https'
-			return false if env_table['HTTPS'].nil? or /off/i =~ env_table['HTTPS'] or env_table['HTTPS'] == ''
-			true
-		end
-
 		def request_uri
 			_request_uri = env_table['REQUEST_URI']
 			_script_name = env_table['SCRIPT_NAME']
@@ -103,81 +107,7 @@ module TDiary
 		end
 
 		def base_url
-			return '' unless script_name
-			begin
-				script_dirname = script_name.empty? ? '' : File::dirname(script_name)
-				if https?
-					port = (server_port == 443) ? '' : ':' + server_port.to_s
-					"https://#{server_name}#{port}#{script_dirname}/"
-				else
-					port = (server_port == 80) ? '' : ':' + server_port.to_s
-					"http://#{server_name}#{port}#{script_dirname}/"
-				end.sub(%r|/+$|, '/')
-			rescue SecurityError
-				''
-			end
-		end
-
-	private
-
-		def build_params
-			source =
-				if request_method == 'POST'
-					if %r|\Amultipart/form-data|.match?( env_table['CONTENT_TYPE'].to_s )
-						@request.POST
-					else
-						# Rack's nested query parser behind request.POST keeps only
-						# the last of duplicated keys; CGI collects all of them.
-						# CGI also splits on ';' as well as '&', and tDiary's own edit
-						# links (00default.rb, edit_today.rb) still use ';'
-						::Rack::Utils.parse_query( read_raw_body, '&;' )
-					end
-				else
-					::Rack::Utils.parse_query( env_table['QUERY_STRING'].to_s, '&;' )
-				end
-
-			params = {}
-			source.each do |key, value|
-				values = value.kind_of?( Array ) ? value : [value]
-				params[key] = values.map {|v| normalize_value( v ) }
-			end
-			params.default = []
-			params
-		end
-
-		def read_raw_body
-			input = env_table['rack.input']
-			return '' unless input
-			# Rack::Request#POST leaves rack.input at EOF, so rewind first in
-			# case the request params were already parsed
-			input.rewind if input.respond_to?( :rewind )
-			body = input.read
-			input.rewind if input.respond_to?( :rewind )
-			body || ''
-		end
-
-		def normalize_value( value )
-			if value.kind_of?( Hash ) and value[:tempfile]
-				# Rack multipart file upload: expose an object responding to
-				# read, which is all the consumers use
-				value[:tempfile]
-			else
-				repair_encoding( value.to_s )
-			end
-		end
-
-		# CGI/FCGI hosting retries broken UTF-8 input as Shift_JIS (index.rb,
-		# misc/lib/fcgi_patch.rb). The facade implements the same fallback on
-		# each value: invalid UTF-8 is converted from Shift_JIS when possible,
-		# otherwise scrubbed.
-		def repair_encoding( str )
-			str = str.dup.force_encoding( Encoding::UTF_8 ) unless str.encoding == Encoding::UTF_8
-			return str if str.valid_encoding?
-			begin
-				str.dup.force_encoding( Encoding::Shift_JIS ).encode( Encoding::UTF_8 )
-			rescue EncodingError
-				str.scrub
-			end
+			tdiary_base_url
 		end
 	end
 end

data/lib/tdiary/configuration.rb

@@ -87,6 +87,7 @@ module TDiary
 				:tdiary_version,
 				:html_title, :author_name, :author_mail, :index_page, :hour_offset,
 				:description, :icon, :banner, :x_frame_options,
+				:referrer_policy, :hsts,
 				:header, :footer,
 				:section_anchor, :comment_anchor, :date_format, :latest_limit, :show_nyear,
 				:theme, :css,
@@ -155,6 +156,9 @@ module TDiary
 
 			@html_title = '' unless @html_title
 			@x_frame_options = nil unless @x_frame_options
+			@referrer_policy = 'strict-origin-when-cross-origin' unless @referrer_policy
+			@hsts = nil unless @hsts
+			@hsts = 'max-age=31536000' if @hsts == true
 			@header = '' unless @header
 			@footer = '' unless @footer