hexo-theme-volantis 5.0.0-rc.3 → 5.0.0-rc.4

package/README.md

@@ -31,6 +31,8 @@ npm i hexo-theme-volantis
 
 See docs: https://volantis.js.org
 
+or:  https://vlts.cc
+
 or:  https://volantis.vercel.app
 
 ## Examples

package/_config.yml

@@ -18,11 +18,38 @@ default:
 ############################### Volantis ###############################
 info:
   theme_name: Volantis # This is theme's name.
-  theme_version: '5.0.0-rc.3' # This is theme's version.
+  theme_version: '5.0.0-rc.4' # This is theme's version.
   theme_docs: https://volantis.js.org/ # This is theme's URL.
   theme_repo: https://github.com/volantis-x/hexo-theme-volantis
 # Debug 调试模式
 debug: false
+############################### CSP ###############################
+# 内容安全策略( CSP )
+# https://developer.mozilla.org/zh-CN/docs/Web/HTTP/CSP
+# https://content-security-policy.com/
+csp:
+  content: "
+    default-src 'self' https:;
+    block-all-mixed-content;
+    base-uri 'self' https:;
+    form-action 'self' https:;
+    worker-src 'self' https:;
+    connect-src 'self' https: *;
+    img-src 'self' data: https: *;
+    media-src 'self' https: *;
+    font-src 'self' data: https: *;
+    frame-src 'self' https: *;
+    manifest-src 'self' https: *;
+    child-src https:;
+    script-src 'self' https: 'unsafe-inline' *;
+    style-src 'self' https: 'unsafe-inline' *;
+  "
+  # 可以使用自动程序替换默认的 'unsafe-inline' 和 * 生成更严格的内容安全策略.
+  # hexo_fliter_sha256 用于 hexo g 时替换 'unsafe-inline' 生成 script-src 'sha256-' , 只适用于外层不含有压缩工具得场景.
+  # 如果外层含有压缩工具会改变 hash 导致无效,hexo_fliter_sha256 需设为false, 使用 gulp 方案.
+  hexo_fliter_sha256: false
+  # 另可以参考官网的 gulp 方案.
+  # gulpfile.js https://github.com/volantis-x/community/blob/main/gulpfile.js
 ############################### CDN ###############################
 # 本地静态文件使用jsdelivr的min版本加速 https://www.jsdelivr.com/features
 # 默认使用 https://cdn.jsdelivr.net/npm/hexo-theme-volantis@<%- theme.info.theme_version %>/source/js/*.min.js 的CDN压缩版本(min.js)，注意版本号对应关系！！可以通过修改以下配置项覆盖
@@ -32,13 +59,15 @@ cdn:
   # CDN 前缀，为空使用默认值，链接最后不加 "/",
   # 例如： https://cdn.jsdelivr.net/gh/volantis-x/volantis-x.github.io@gh-page 填写最后编译生成的源码CDN地址前缀，此路径下应该含有/js与/css目录,
   # 该配置默认值是："https://cdn.jsdelivr.net/npm/hexo-theme-volantis@"+ theme.info.theme_version +"/source"
-  prefix: https://npm.elemecdn.com/hexo-theme-volantis@5.0.0-rc.3/source
+  prefix: https://npm.elemecdn.com/hexo-theme-volantis@5.0.0-rc.4/source
   # 以下配置可以覆盖 cdn.prefix,配置项的值可以为空，但是要使用CDN必须依据路径填写配置项的键
   set:
     js:
       app: /js/app.js
     css:
       style: /css/style.css # (异步加载样式)
+# 请求静态资源添加时间戳 ?time=1648684470140
+cdn_version: true
 ########################################################################
 # 全局页面字符串替换  A => B (可用于临时修改错字等)
 replace:
@@ -273,9 +302,6 @@ comments:
   # https://giscus.app
   # https://github.com/laymonage/giscus
   giscus:
-    theme:
-      light: "light" # https://cdn.jsdelivr.net/gh/volantis-x/cdn-volantis@master/css/giscus/light.css
-      dark: "dark" # https://cdn.jsdelivr.net/gh/volantis-x/cdn-volantis@master/css/giscus/dark.css
     # 以下配置按照 yml 格式增删填写即可
     # repo: xxx/xxx
     # repo-id: xxx
@@ -285,6 +311,10 @@ comments:
     # reactions-enabled: "1"
     # emit-metadata: "0"
     # lang: "zh-CN"
+    # 以上配置按照 yml 格式增删填写即可
+    theme:
+      light: "light" # https://cdn.jsdelivr.net/gh/volantis-x/cdn-volantis@master/css/giscus/light.css
+      dark: "dark" # https://cdn.jsdelivr.net/gh/volantis-x/cdn-volantis@master/css/giscus/dark.css
 
   # beaudar
   # https://beaudar.lipk.org/
@@ -415,7 +445,7 @@ comments:
   # Waline
   # https://waline.js.org/
   waline:
-    js: https://cdn.jsdelivr.net/npm/@waline/client/dist/Waline.min.js
+    js: https://npm.elemecdn.com/@waline/client@1.6.0/dist/Waline.min.js
     path: # 全局评论地址 目前设置全局评论地址后visitor失效,这是waline的问题
     placeholder: 快来评论吧~  # 评论占位提示
     # imageHosting: https://7bu.top/api/upload?token=7ffe9d626fe4315c953758efbdb6ee2e # 图床api（默认注释使用base64）
@@ -607,8 +637,8 @@ plugins:
   # jquery
   globalJquery: false # 全局引入 jquery
   jquery: /libs/jquery/dist/jquery.min.js # https://cdn.jsdelivr.net/npm/jquery@3.6.0/dist/jquery.min.js
-  # fontawesome Pro 版本：https://cdn.jsdelivr.net/gh/inkss/fontawesome@5.15.3/css/all.min.css
-  fontawesome: /libs/@fortawesome/fontawesome-free/css/all.min.css # https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5.14/css/all.min.css
+  # fontawesome Pro 版本：https://cdn.jsdelivr.net/gh/inkss/fontawesome@6.0.0/css/all.min.css
+  fontawesome: /libs/@fortawesome/fontawesome-free/css/all.min.css # https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.1/css/all.min.css
   # katex@0.15.2
   katex:
     js: /libs/katex/katex.min.js # https://cdn.jsdelivr.net/npm/katex@0.15.2/dist/katex.min.js
@@ -851,17 +881,14 @@ plugins:
 
   # 友链朋友圈 hexo-circle-of-friends
   # https://github.com/Rock-Candy-Tea/hexo-circle-of-friends
-  # https://zfe.space/post/friend-link-circle.html
+  # https://fcircle-doc.js.cool/
   fcircle:
     # Set `plugins: ["fcircle"]` to enable in front-matter
     # 支持 Pjax
     api: '' # api 地址
-    max_number: 20 # 页面展示文章数量
-    add_number: 10 # 每次加载增加的篇数
-    opentype: '_blank' # '_blank'打开新标签,'_self'本窗口打开
-    nofollow: true # 禁止搜索引擎抓取
-    imgError: https://cdn.jsdelivr.net/gh/Zfour/Butterfly-friend-poor-html/friendcircle/404.png
-    # loadingCutom: # 自定义loading图 例如: <i class="fa fa-spinner fa-spin"></i> | <img src="你的图片地址" alt="加载中...">
+    message: '与主机通讯中……'  # 占位文字
+    css: 'https://cdn.jsdelivr.net/gh/lmm214/immmmm/themes/hello-friend/static/fcircle-beta.css'
+    js: 'https://cdn.jsdelivr.net/gh/lmm214/immmmm/themes/hello-friend/static/fcircle-beta.js'
 
   # 消息提示
   message:
@@ -936,7 +963,6 @@ rightmenu:
   print:                  # 只有文章页才允许自定义打印
     name: 打印页面
     icon: fa fa-print
-    defaultStyles: true   # 是否使用预制的打印样式
   darkmode:        # 需开启 plugins.darkmodejs
     name: 暗黑模式
     icon: fa fa-moon

package/layout/_partial/head.ejs

@@ -11,6 +11,7 @@
   <meta name="renderer" content="webkit">
   <meta name="force-rendering" content="webkit">
   <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1">
+  <meta http-equiv="Content-Security-Policy" content="<%- theme.csp.content %>">
   <meta name="HandheldFriendly" content="True" >
   <meta name="apple-mobile-web-app-capable" content="yes">
   <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=5">

package/layout/_partial/scripts/_ctrl/cdnCtrl.ejs

@@ -4,6 +4,10 @@
   // theme.cdn.addCSS("first","first",theme.cdn.set.css.first)  => theme.cdn.map.css.first
 
   theme.cdnCtrl={}
+  theme.cdnCtrl.cdn_version = "";
+  if (theme.cdn_version) {
+    theme.cdnCtrl.cdn_version = '?time=' + theme.getStartTime;
+  }
   if (theme.cdn.enable&&theme.cdn.prefix) {
     theme.cdnCtrl.prefix=theme.cdn.prefix.replace(/\/$/g, "")
   } else {
@@ -14,7 +18,7 @@
   theme.cdn.map.css={}
   theme.cdn.addJS=(name,source,force)=>{
     if(force){
-      theme.cdn.map.js[name]=force + '?time=' + Date.now()
+      theme.cdn.map.js[name]=force + theme.cdnCtrl.cdn_version
     }else{
       if(!source){
         source=name
@@ -23,16 +27,16 @@
       if (theme.cdn.enable) {
         let suffix=theme.cdn.prefix&&theme.cdn.prefix.match(/jsdelivr/g)?'.min.js':'.js'
         source= (suffix==".min.js")?source.replace(/\.min/g, ""):source
-        theme.cdn.map.js[name]=theme.cdnCtrl.prefix + '/js/' + source + suffix + '?time=' + Date.now()
+        theme.cdn.map.js[name]=theme.cdnCtrl.prefix + '/js/' + source + suffix + theme.cdnCtrl.cdn_version
       } else {
-        theme.cdn.map.js[name]=url_for('/js/')+ source + '.js?time=' + Date.now()
+        theme.cdn.map.js[name]=url_for('/js/')+ source + '.js' + theme.cdnCtrl.cdn_version
       }
     }
     return theme.cdn.map.js[name]
   }
   theme.cdn.addCSS=(name,source,force)=>{
     if(force){
-      theme.cdn.map.css[name]=force + '?time=' + Date.now()
+      theme.cdn.map.css[name]=force + theme.cdnCtrl.cdn_version
     }else{
       if(!source){
         source=name
@@ -41,9 +45,9 @@
       if (theme.cdn.enable&&theme.cdn.prefix) {
         let suffix=theme.cdn.prefix.match(/jsdelivr/g)?'.min.css':'.css'
         source= (suffix==".min.js")?source.replace(/\.min/g, ""):source
-        theme.cdn.map.css[name]=theme.cdnCtrl.prefix + '/css/' + source + suffix + '?time=' + Date.now()
+        theme.cdn.map.css[name]=theme.cdnCtrl.prefix + '/css/' + source + suffix + theme.cdnCtrl.cdn_version
       } else {
-        theme.cdn.map.css[name]=url_for('/css/')+ source + '.css?time=' + Date.now()
+        theme.cdn.map.css[name]=url_for('/css/')+ source + '.css' + theme.cdnCtrl.cdn_version
       }
     }
     return theme.cdn.map.css[name]
@@ -109,5 +113,7 @@
   //  在部署时加入了 ?time=' + Date.now()
   //  使用 js(theme.cdn.map.js.app) 引入的地址会形如: /js/app.js?time=1232123123.js
   //  但是无伤大雅
+  //  更新：
+  //  ?time=' + Date.now() 替换为 theme.getStartTime 保证相同资源 hash 不变
   dfs(theme.cdn.set,[])
 _%>

package/layout/_partial/scripts/global.ejs

@@ -7,7 +7,7 @@
   volantis.GLOBAL_CONFIG ={
     cdn: <%- JSON.stringify(theme.cdn.map) %>,
     default: <%- JSON.stringify(theme.default) %>,
-    lastupdate: new Date('<%- new Date() %>'),
+    lastupdate: new Date('<%- theme.getStartTime %>'),
     sidebar: {
       for_page: <%- JSON.stringify(theme.sidebar.for_page) %>,
       for_post: <%- JSON.stringify(theme.sidebar.for_post) %>,
@@ -33,8 +33,7 @@
         faicon: <%- JSON.stringify(theme.rightmenu.faicon) %>,
         layout: <%- JSON.stringify(theme.rightmenu.layout) %>,
         music_alwaysShow: <%- JSON.stringify(theme.rightmenu.music.alwaysShow) %>,
-        customPicUrl: <%- JSON.stringify(theme.rightmenu.customPicUrl) %>,
-        print: <%- JSON.stringify(theme.rightmenu.print.defaultStyles) %>
+        customPicUrl: <%- JSON.stringify(theme.rightmenu.customPicUrl) %>
       }
     }
   }
@@ -385,4 +384,14 @@
   }
   /******************************************************************************/
   /******************************************************************************/
+  //图像加载出错时的处理
+  function errorImgAvatar(img) {
+    img.src = "<%- theme.default.avatar %>";
+    img.onerror = null;
+  }
+  function errorImgCover(img) {
+    img.src = "<%- theme.default.cover %>";
+    img.onerror = null;
+  }
+  /******************************************************************************/
 </script>

package/layout/_plugins/_page_plugins/fcircle/index.ejs

@@ -1,226 +1,12 @@
 <script>
-  volantis.layoutHelper("page-plugins",`<div id="moments_container"></div>`,{pjax:false}) // 外层有 pjax 标签
+  volantis.layoutHelper("page-plugins",`<div class="post-content"><div id="cf-container"><%- theme.plugins.fcircle.message %></div></div>`,{pjax:false}) // 外层有 pjax 标签
 </script>
-<script>
-  var requests_url = '<%- theme.plugins.fcircle.api %>';
-  var orign_data = [];
-  var maxnumber = <%- theme.plugins.fcircle.max_number %>;
-  var addnumber = <%- theme.plugins.fcircle.add_number %>;
-  var opentype = '<%- theme.plugins.fcircle.opentype %>';
-  var nofollow = <%- theme.plugins.fcircle.nofollow %>;
-  var loadingCutom = '<%- theme.plugins.fcircle.loadingCutom %>';
-  var fcircleImgError = '<%- theme.plugins.fcircle.imgError %>';
-
-  //处理数据
-
-  if (document.getElementById('moments_container')) {
-      //添加加载动画
-      var loading_pic = document.getElementById('moments_container');
-
-      // 判断loadingCutom值是否为空
-      if (typeof loadingCutom == "undefined" || loadingCutom == null || loadingCutom === "") {
-          loading_pic.innerHTML = '<style>.loader { color: #d9dad8; font-size: 90px; text-indent: -9999em; overflow: hidden; width: 1em; height: 1em; border-radius: 50%; margin: 72px auto; position: relative; -webkit-transform: translateZ(0); -ms-transform: translateZ(0); transform: translateZ(0); -webkit-animation: load6 1.7s infinite ease, round 1.7s infinite ease; animation: load6 1.7s infinite ease, round 1.7s infinite ease; } @-webkit-keyframes load6 { 0% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } 5%, 95% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } 10%, 59% { box-shadow: 0 -0.83em 0 -0.4em, -0.087em -0.825em 0 -0.42em, -0.173em -0.812em 0 -0.44em, -0.256em -0.789em 0 -0.46em, -0.297em -0.775em 0 -0.477em; } 20% { box-shadow: 0 -0.83em 0 -0.4em, -0.338em -0.758em 0 -0.42em, -0.555em -0.617em 0 -0.44em, -0.671em -0.488em 0 -0.46em, -0.749em -0.34em 0 -0.477em; } 38% { box-shadow: 0 -0.83em 0 -0.4em, -0.377em -0.74em 0 -0.42em, -0.645em -0.522em 0 -0.44em, -0.775em -0.297em 0 -0.46em, -0.82em -0.09em 0 -0.477em; } 100% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } } @keyframes load6 { 0% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } 5%, 95% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } 10%, 59% { box-shadow: 0 -0.83em 0 -0.4em, -0.087em -0.825em 0 -0.42em, -0.173em -0.812em 0 -0.44em, -0.256em -0.789em 0 -0.46em, -0.297em -0.775em 0 -0.477em; } 20% { box-shadow: 0 -0.83em 0 -0.4em, -0.338em -0.758em 0 -0.42em, -0.555em -0.617em 0 -0.44em, -0.671em -0.488em 0 -0.46em, -0.749em -0.34em 0 -0.477em; } 38% { box-shadow: 0 -0.83em 0 -0.4em, -0.377em -0.74em 0 -0.42em, -0.645em -0.522em 0 -0.44em, -0.775em -0.297em 0 -0.46em, -0.82em -0.09em 0 -0.477em; } 100% { box-shadow: 0 -0.83em 0 -0.4em, 0 -0.83em 0 -0.42em, 0 -0.83em 0 -0.44em, 0 -0.83em 0 -0.46em, 0 -0.83em 0 -0.477em; } } @-webkit-keyframes round { 0% { -webkit-transform: rotate(0deg); transform: rotate(0deg); } 100% { -webkit-transform: rotate(360deg); transform: rotate(360deg); } } @keyframes round { 0% { -webkit-transform: rotate(0deg); transform: rotate(0deg); } 100% { -webkit-transform: rotate(360deg); transform: rotate(360deg); } }</style><center><span id="moments_loading"><div class="loader"></div></span></center>';
-      } else {
-          loading_pic.innerHTML = '<center><span id="moments_loading">' + loadingCutom + '</span></center>';
-      }
-
-      fetch(requests_url).then(
-          data => data.json()
-      ).then(
-          data => {
-              orign_data = data;
-              data_handle(nofollow, orign_data, maxnumber)
-          }
-      )
-  }
-
-  var data_handle = (nofollow, data, maxnumber) => {
-      var today = todaypost();
-      var Datetody = new Date(today);
-      for (var item = 0; item < data[1].length; item++) {
-          var Datedate = new Date(data[1][item][1]);
-          if (Datedate > Datetody) {
-              data[1].splice(item--, 1);
-          }
-      }
-      var today_post = 0;
-      var error = 0;
-      var unique_live_link;
-      var datalist = data[1].slice(0, maxnumber);
-      var listlenth = data[1].length;
-      var user_lenth = data[0].length;
-      var datalist_slice = slice_month(datalist);
-      var last_update_time = timezoon(datalist_slice);
-      var link_list = [];
-      for (var item of data[1]) {
-          if (item[1] === today) {
-              today_post += 1;
-          }
-          link_list.push(item[3]);
-      }
-      var arr = unique(link_list);
-      unique_live_link = arr.length;
-      for (var item of data[0]) {
-          if (item[3] === 'true') {
-              error += 1;
-          }
-      }
-      var html_item = '<h2>统计信息</h2>';
-      html_item += '<div id="info_user_pool" class="moments-item info_user_pool" style="">';
-      html_item += '<div class="moments_chart"><span class="moments_post_info_title">当前友链数：</span><span class="moments_post_info_number">' + user_lenth + ' 个</span><br><span class="moments_post_info_title">失败数：</span><span class="moments_post_info_number">' + error + ' 个</span><br></div>';
-      html_item += '<div class="moments_chart"><span class="moments_post_info_title">活跃友链数：</span><span class="moments_post_info_number">' + unique_live_link + ' 个</span><br><span class="moments_post_info_title">当前库存：</span><span class="moments_post_info_number">' + listlenth + ' 篇</span><br></div>';
-      html_item += '<div class="moments_chart"><span class="moments_post_info_title">今日更新：</span><span class="moments_post_info_number">' + today_post + ' 篇</span><br><span class="moments_post_info_title">最近更新：</span><span class="moments_post_info_number">' + last_update_time + '</span><br></div>';
-      html_item += '</div>';
-
-      for (var month_item of datalist_slice) {
-          html_item += '<h2>' + month_item[0] + '</h2>';
-          for (var post_item of month_item[1]) {
-              var rel = '';
-              if (nofollow && opentype == '_blank') {
-                  rel = 'noopener nofollow';
-              } else if (nofollow) {
-                  rel = 'nofollow';
-              } else if (opentype == '_blank') {
-                  rel = 'noopener';
-              } else {
-                  rel = '';
-              }
-              html_item += ' <div class="moments-item">';
-              html_item += ' <a target="' + opentype + '" class="moments-item-img" href="' + post_item[2] + '" title="' + post_item[0] + '"rel="' + rel + '">';
-              html_item += '<img onerror="this.onerror=null,this.src=&quot;' + fcircleImgError + '&quot;"';
-              html_item += ' src="' + post_item[4] + '"></a>';
-              html_item += '<div class="moments-item-info"><div class="moments-item-time"><i class="far fa-user"></i>';
-              html_item += '<span>' + post_item[3] + '</span>';
-              html_item += ' <div class="moments_post_time"><i class="far fa-calendar-alt"></i>' +
-                  '<time datetime="' + post_item[1] + '" title="' + post_item[1] + '">' + post_item[1] + '</time></div>';
-              html_item += `</div><a target="${opentype}" class="moments-item-title" href="${post_item[2]}" title="${post_item[0]}"rel="${rel}">${post_item[0]}</a></div>`;
-              html_item += '</div>';
-
-          }
-      }
-      if (data[1].length - maxnumber > 0) {
-          html_item += '<div style="text-align: center"><button type="button" class="moments_load_button" ' +
-              'onclick="load_more_post()">加载更多...</button>' +
-              '</div>'
-      }
-      html_item += '<style>.moments-item-info span{padding-left:.3rem;padding-right:.3rem}.moments_post_time time{padding-left:.3rem;cursor:default}.moments_post_info_title{font-weight:700}.moments_post_info_number{float:right}.moments_chart{align-items:flex-start;flex:1;width:100px;height:60px;margin:20px}@media screen and (max-width:500px){.info_user_pool{padding:10px;flex-direction:column;max-height:200px}.moments_chart{flex:0;width:100%;height:160px;margin:0}}.moments-item:before{border:0}@media screen and (min-width:500px){.moments_post_time{float:right}}.moments_load_button{-webkit-transition-duration:.4s;transition-duration:.4s;text-align:center;border:1px solid #ededed;border-radius:.3em;display:inline-block;background:transparent;color:#555;padding:.5em 1.25em}.moments_load_button:hover{color:#3090e4;border-color:#3090e4}.moments-item{position:relative;display:-webkit-box;display:-moz-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-box-align:center;-moz-box-align:center;-o-box-align:center;-ms-flex-align:center;-webkit-align-items:center;align-items:center;margin:0 0 1rem .5rem;-webkit-transition:all .2s ease-in-out;-moz-transition:all .2s ease-in-out;-o-transition:all .2s ease-in-out;-ms-transition:all .2s ease-in-out;transition:all .2s ease-in-out;box-shadow:rgba(0,0,0,0.07) 0 2px 2px 0,rgba(0,0,0,0.1) 0 1px 5px 0;border-radius:2px}.moments-item-img{overflow:hidden;width:80px;height:80px}.moments-item-img img{max-width:100%;width:100%;height:100%;object-fit:cover}.moments-item-info{-webkit-box-flex:1;-moz-box-flex:1;-o-box-flex:1;box-flex:1;-webkit-flex:1;-ms-flex:1;flex:1;padding:0 .8rem}.moments-item-title{display:-webkit-box;overflow:hidden;-webkit-box-orient:vertical;font-size:1.1em;-webkit-transition:all .3s;-moz-transition:all .3s;-o-transition:all .3s;-ms-transition:all .3s;transition:all .3s;-webkit-line-clamp:1}</style>'
-
-
-
-      var moments_container = document.getElementById('moments_container');
-      append_div(moments_container, html_item)
-  };
-
-  var load_more_post = () => {
-      if (document.getElementById('moments_container')) {
-          maxnumber = maxnumber + addnumber;
-          document.getElementById('moments_container').innerHTML = "";
-          data_handle(nofollow, orign_data, maxnumber)
-      }
-  };
-
-
-
-  //加载更多文章
-  //将html放入指定id的div容器
-  var append_div = (parent, text) => {
-      if (document.getElementById('moments_container')) {
-          loading_pic.innerHTML = ``;
-      };
-      if (typeof text === 'string') {
-          var temp = document.createElement('div');
-          temp.innerHTML = text;
-          // 防止元素太多 进行提速
-          var frag = document.createDocumentFragment();
-          while (temp.firstChild) {
-              frag.appendChild(temp.firstChild);
-          }
-          parent.appendChild(frag);
-      } else {
-          parent.appendChild(text);
-      }
-  };
-
-  //去重
-  var unique = (arr) => {
-      return Array.from(new Set(arr))
-  };
-
-  //时区优化
-  var formatDate = (strDate) => {
-      try {
-          var date = new Date(Date.parse(strDate.replace(/-/g, "/")));
-          var gettimeoffset;
-          if (new Date().getTimezoneOffset()) {
-              gettimeoffset = new Date().getTimezoneOffset();
-          } else {
-              gettimeoffset = 8;
-          }
-          var timeoffset = gettimeoffset * 60 * 1000;
-          var len = date.getTime();
-          var date2 = new Date(len - timeoffset);
-          var sec = date2.getSeconds().toString();
-          var min = date2.getMinutes().toString();
-          if (sec.length === 1) {
-              sec = "0" + sec;
-          }
-          if (min.length === 1) {
-              min = "0" + min;
-          }
-          return date2.getFullYear().toString() + "/" + (date2.getMonth() + 1).toString() + "/" + date2.getDate().toString() + " " + date2.getHours().toString() + ":" + min + ":" + sec
-      } catch (e) {
-          return ""
-      }
-  };
-
-  var timezoon = (datalist_slice) => {
-      var time = datalist_slice[0][1][0][5];
-      return formatDate(time)
-  };
-
-  //今日时间
-  var todaypost = () => {
-      var date = new Date();
-      var year = date.getFullYear();
-      var month = (date.getMonth() + 1).toString();
-      var day = (date.getDate()).toString();
-      if (month.length === 1) {
-          month = "0" + month;
-      }
-      if (day.length === 1) {
-          day = "0" + day;
-      }
-      return year + "-" + month + "-" + day
-  };
-
-  //月份切片
-  var slice_month = (data) => {
-      var monthlist = [];
-      var datalist = [];
-      var data_slice = data;
-      for (var item in data_slice) {
-          data_slice[item].push(item);
-          if (data_slice[item][1].lenth !== 10) {
-              var list = data_slice[item][1].split('-');
-              if (list[1].length < 2) {
-                  list[1] = "0" + list[1]
-              }
-              if (list[2].length < 2) {
-                  list[2] = "0" + list[2]
-              }
-              data_slice[item][1] = list.join('-')
-          }
-          var month = data_slice[item][1].slice(0, 7);
-          if (monthlist.indexOf(month) !== -1) {
-              datalist[monthlist.length - 1][1].push(data_slice[item])
-          } else {
-              monthlist.push(month);
-              datalist.push([month, [data_slice[item]]])
-          }
-      }
-      for (var mounthgroup of datalist) {
-          mounthgroup.push(mounthgroup[1][0][6]);
-      }
-      return datalist
-  };
+<script type="text/javascript">
+    var fdataUser = {
+        apiurl: '<%- theme.plugins.fcircle.api %>'
+    }
+</script>
+<link rel="stylesheet" href="<%- theme.plugins.fcircle.css %>">
+<script type="text/javascript"
+    src="<%- theme.plugins.fcircle.js %>">
 </script>

package/layout/_plugins/parallax/script.ejs

@@ -1,7 +1,11 @@
 <%_
-var imgs = theme.plugins.parallax.images || page.images; 
-if (theme.plugins.parallax.shuffle) { 
-  shuffle(imgs);
+theme.plugins.parallax.images = theme.plugins.parallax.images || page.images; 
+if (theme.plugins.parallax.shuffle) {
+  // shuffle 只一次 防止 hash 变化
+  if (typeof theme.plugins.parallax.shuffle_end==='undefined') {
+    shuffle(theme.plugins.parallax.images);
+    theme.plugins.parallax.shuffle_end=1;
+  }
 }
 function shuffle(arr){
   var n = arr.length;
@@ -14,7 +18,7 @@ function shuffle(arr){
 }
 _%>
 <script>
-  let imgs = <%- JSON.stringify(imgs) %>;
+  let imgs = <%- JSON.stringify(theme.plugins.parallax.images) %>;
   let index = 0;
   let IntervalParallax = null;
 

package/layout/_plugins/pjax/index.ejs

@@ -17,7 +17,7 @@
     var pjax;
     document.addEventListener('DOMContentLoaded', function () {
       pjax = new Pjax({
-        elements: 'a[href]:not([href^="#"]):not([href="javascript:void(0)"]):not([pjax-fancybox]):not([onclick="return false;"]):not([target="_blank"]):not([target="view_window"]):not([href$=".xml"])',
+        elements: 'a[href]:not([href^="#"]):not([href="javascript:void(0)"]):not([pjax-fancybox]):not([onclick="return false;"]):not([onclick="return!1"]):not([target="_blank"]):not([target="view_window"]):not([href$=".xml"])',
         selectors: [
           "head title",
           "head meta[name='description']",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hexo-theme-volantis",
-  "version": "5.0.0-rc.3",
+  "version": "5.0.0-rc.4",
   "description": "Elegant and powerful theme for Hexo.",
   "main": "package.json",
   "scripts": {

package/scripts/events/lib/config.js

@@ -60,7 +60,7 @@ module.exports = hexo => {
     hexo.config.relative_link = false;
   }
   hexo.config.meta_generator = false;
-
+  hexo.theme.config.getStartTime = Date.now();
   // Custom languages support. Introduced in NexT v6.3.0.
   if (data.languages) {
     var { language } = hexo.config;

package/scripts/filters/CSP.js

@@ -0,0 +1,71 @@
+/* global hexo */
+
+'use strict';
+
+const crypto = require('crypto');
+const hash = (s) => crypto.createHash("sha256").update(s).digest('base64');
+
+// script White list [scripts in event handlers (eg onclick)]. 包含压缩的 inline js
+let unsafe_script_list = [
+  "this.media='all';this.onload=null",
+  'this.media="all",this.onload=null',
+  "errorImgAvatar(this)",
+  "errorImgCover(this)",
+  "return false;",
+  "return!1",
+]
+// script hash White list
+let unsafe_script_hash = ["'sha256-MXV1jvkHrZruEyFEOrQRjKs9WlPZC1V/3RLoKrkoDFQ='"]
+
+function getRandStr(len) {
+  var str = '';
+  for (var i = 0; i < len; i++) {
+    str += String.fromCharCode(Math.floor(Math.random() * 26) + 97);
+  }
+  return str;
+}
+let unsafe_script_list_get = 1
+const nonce = getRandStr(15);
+
+hexo.extend.filter.register('after_render:html', function(data) {
+  if (!hexo.theme.config.csp.hexo_fliter_sha256) return data;
+  let arg = process.argv[2];
+  if (arg != "g" && arg != "generate") {
+    return data;
+  }
+  data = data.replace(/<script.*?>/g, function (match) {
+    if (/src/g.test(match)) {
+      return match;
+    }
+    if (/type=\"application\/ld\+json\"/g.test(match)) {
+      return match;
+    }
+    return match.replace(/>/g, ` nonce='${nonce}'>`);
+  });
+  data.replace(/<script.*?>([\s\S]+?)<\/script>/gi, function (match, script) {
+    if (/type=\"application\/ld\+json\"/g.test(match)) {
+      return match;
+    }
+    unsafe_script_list.push(script)
+    return match;
+  });
+  return data;
+},9999999999999);
+
+hexo.extend.filter.register('after_render:html', function(data) {
+  if (!hexo.theme.config.csp.hexo_fliter_sha256) return data;
+  let arg = process.argv[2];
+  if (arg != "g" && arg != "generate") {
+    return data;
+  }else{
+    if (unsafe_script_list_get) {
+      unsafe_script_list=Array.from(new Set(unsafe_script_list))
+      unsafe_script_list.forEach(e => {
+        unsafe_script_hash.push("'sha256-" + hash(e) + "'")
+      });
+      unsafe_script_list_get = 0;
+    }
+    data = data.replace(/script-src 'self' https: 'unsafe-inline'/g, `script-src 'self' https: 'nonce-${nonce}' 'unsafe-hashes' ` + unsafe_script_hash.join(" "));
+    return data;
+  }
+},99999999999999999);

package/scripts/tags/contributors.js

@@ -52,7 +52,7 @@ hexo.extend.tag.register('contributors', function(args) {
     if (friend.url && friend.title) {
       var cell = '<div class="user-card">';
       cell += '<a class="card-link" target="_blank" rel="external noopener noreferrer" href="' + friend.url + '">';
-      cell += '<img src="' + (friend.avatar || hexo.theme.config.default.avatar) + '" onerror="this.onerror=null;this.classList.add(&quot;loaded&quot;);this.srcset=this.src=&quot;' + hexo.theme.config.default.avatar + '&quot;;"/>';
+      cell += '<img src="' + (friend.avatar || hexo.theme.config.default.avatar) + '" onerror="errorImgAvatar(this)"/>';
       cell += '<div class="name"><span>' + friend.title + '</span></div>';
       cell += '</a></div>'
       return cell;

package/scripts/tags/friends.js

@@ -51,7 +51,7 @@ hexo.extend.tag.register('friends', function(args) {
     if (friend.url && friend.title) {
       var cell = '<div class="user-card">';
       cell += '<a class="card-link" target="_blank" rel="external noopener noreferrer" href="' + friend.url + '">';
-      cell += '<img src="' + (friend.avatar || hexo.theme.config.default.avatar) + '" onerror="this.onerror=null;this.classList.add(&quot;loaded&quot;);this.srcset=this.src=&quot;' + hexo.theme.config.default.avatar + '&quot;;"/>';
+      cell += '<img src="' + (friend.avatar || hexo.theme.config.default.avatar) + '" onerror="errorImgAvatar(this)"/>';
       cell += '<div class="name"><span>' + friend.title + '</span></div>';
       cell += '</a></div>'
       return cell;

package/scripts/tags/site.js

@@ -43,9 +43,9 @@ hexo.extend.tag.register('sites', function(args) {
     if (site.url && site.title) {
       var cell = '<div class="site-card">';
       cell += '<a class="card-link" target="_blank" rel="external noopener noreferrer" href="' + site.url + '">';
-      cell += '<img src="' + (site.screenshot || ('https://image.thum.io/get/width/1024/crop/768/' + site.url)) + '" onerror="this.onerror=null;this.classList.add(&quot;loaded&quot;);this.srcset=this.src=&quot;' + hexo.theme.config.default.cover + '&quot;;"/>';
+      cell += '<img src="' + (site.screenshot || ('https://image.thum.io/get/width/1024/crop/768/' + site.url)) + '" onerror="errorImgCover(this)"/>';
       cell += '<div class="info">';
-      cell += '<img src="' + (site.avatar || hexo.theme.config.default.link) + '" onerror="this.onerror=null;this.classList.add(&quot;loaded&quot;);this.srcset=this.src=&quot;' + hexo.theme.config.default.link + '&quot;;"/>';
+      cell += '<img src="' + (site.avatar || hexo.theme.config.default.link) + '" onerror="errorImgAvatar(this)"/>';
       cell += '<span class="title">' + site.title + '</span>';
       cell += '<span class="desc">' + (site.description || site.url) + '</span>';
       cell += '</div>';

package/source/css/_style/_layout/main.styl

@@ -50,6 +50,8 @@
     padding-right: $gap
   if hexo-config('sidebar.position') =='left'
     padding-left: $gap
+    @media screen and (max-width:$device-tablet)
+      padding-left: 0
   &.no_sidebar
     width: 100%
     padding-right: 0

package/source/css/_style/_layout/sidebar.styl

@@ -7,7 +7,6 @@
     -ms-flex-order: 1;
     -webkit-order: 1;
     order: 1;
-    padding-left: $gap
   position: relative
   display: flex
   flex-direction: column

package/source/js/plugins/contributors.js

@@ -52,7 +52,7 @@ const ContributorsJS = {
         var user = '<div class="user-card">';
         user += '<a class="card-link" target="_blank" rel="external noopener noreferrer"';
         user += ' href="' + item.html_url + '">';
-        user += '<img alt="' + item.login + '" src="' + (item.avatar_url || cfg.avatar) + '" onerror="javascript:this.onerror=null;this.src=\'' + cfg.avatar + '\';">';
+        user += '<img alt="' + item.login + '" src="' + (item.avatar_url || cfg.avatar) + '" onerror="errorImgAvatar(this)">';
         user += '<div class="name"><span>' + item.login + '</span></div>';
         user += '</a>';
         user += '</div>';

package/source/js/plugins/friends.js

@@ -53,7 +53,7 @@ const FriendsJS = {
         var user = '<div class="user-card">';
         user += '<a class="card-link" target="_blank" rel="external noopener noreferrer"';
         user += ' href="' + item.url + '">';
-        user += '<img alt="' + item.title + '" src="' + (item.avatar || cfg.avatar) + '" onerror="javascript:this.onerror=null;this.src=\'' + cfg.avatar + '\';">';
+        user += '<img alt="' + item.title + '" src="' + (item.avatar || cfg.avatar) + '" onerror="errorImgAvatar(this)">';
         user += '<div class="name"><span>' + item.title + '</span></div>';
         user += '</a>';
         user += '</div>';

package/source/js/plugins/rightMenu.js

@@ -437,40 +437,38 @@ const RightMenu = (() => {
   // 执行打印页面 
   fn.printHtml = () => {
     if (volantis.isReadModel) fn.readingModel();
-    if (rightMenuConfig.print.defaultStyles) {
-      DOMController.setAttribute('details', 'open', 'true');
-      DOMController.remove('.cus-article-bkg');
-      DOMController.remove('.iziToast-overlay');
-      DOMController.remove('.iziToast-wrapper');
-      DOMController.remove('.prev-next');
-      DOMController.remove('footer');
-      DOMController.remove('#l_header');
-      DOMController.remove('#l_cover');
-      DOMController.remove('#l_side');
-      DOMController.remove('#comments');
-      DOMController.remove('#s-top');
-      DOMController.remove('#BKG');
-      DOMController.remove('#rightmenu-wrapper');
-      DOMController.remove('.nav-tabs');
-      DOMController.remove('.parallax-mirror');
-      DOMController.remove('.new-meta-item.share');
-      DOMController.remove('div.footer');
-      DOMController.setStyle('body', 'backgroundColor', 'unset');
-      DOMController.setStyle('#l_main', 'width', '100%');
-      DOMController.setStyle('#post', 'boxShadow', 'none');
-      DOMController.setStyle('#post', 'background', 'none');
-      DOMController.setStyle('#post', 'padding', '0');
-      DOMController.setStyle('h1', 'textAlign', 'center');
-      DOMController.setStyle('h1', 'fontWeight', '600');
-      DOMController.setStyle('h1', 'fontSize', '2rem');
-      DOMController.setStyle('h1', 'marginBottom', '20px');
-      DOMController.setStyle('.tab-pane', 'display', 'block');
-      DOMController.setStyle('.tab-content', 'borderTop', 'none');
-      DOMController.setStyle('.highlight>table pre', 'whiteSpace', 'pre-wrap');
-      DOMController.setStyle('.highlight>table pre', 'wordBreak', 'break-all');
-      DOMController.setStyle('.fancybox img', 'height', 'auto');
-      DOMController.setStyle('.fancybox img', 'weight', 'auto');
-    }
+    DOMController.setAttribute('details', 'open', 'true');
+    DOMController.remove('.cus-article-bkg');
+    DOMController.remove('.iziToast-overlay');
+    DOMController.remove('.iziToast-wrapper');
+    DOMController.remove('.prev-next');
+    DOMController.remove('footer');
+    DOMController.remove('#l_header');
+    DOMController.remove('#l_cover');
+    DOMController.remove('#l_side');
+    DOMController.remove('#comments');
+    DOMController.remove('#s-top');
+    DOMController.remove('#BKG');
+    DOMController.remove('#rightmenu-wrapper');
+    DOMController.remove('.nav-tabs');
+    DOMController.remove('.parallax-mirror');
+    DOMController.remove('.new-meta-item.share');
+    DOMController.remove('div.footer');
+    DOMController.setStyle('body', 'backgroundColor', 'unset');
+    DOMController.setStyle('#l_main', 'width', '100%');
+    DOMController.setStyle('#post', 'boxShadow', 'none');
+    DOMController.setStyle('#post', 'background', 'none');
+    DOMController.setStyle('#post', 'padding', '0');
+    DOMController.setStyle('h1', 'textAlign', 'center');
+    DOMController.setStyle('h1', 'fontWeight', '600');
+    DOMController.setStyle('h1', 'fontSize', '2rem');
+    DOMController.setStyle('h1', 'marginBottom', '20px');
+    DOMController.setStyle('.tab-pane', 'display', 'block');
+    DOMController.setStyle('.tab-content', 'borderTop', 'none');
+    DOMController.setStyle('.highlight>table pre', 'whiteSpace', 'pre-wrap');
+    DOMController.setStyle('.highlight>table pre', 'wordBreak', 'break-all');
+    DOMController.setStyle('.fancybox img', 'height', 'auto');
+    DOMController.setStyle('.fancybox img', 'weight', 'auto');
 
     setTimeout(() => {
       window.print();

package/source/js/plugins/sites.js

@@ -52,9 +52,9 @@ const SitesJS = {
       arr.forEach((item, i) => {
         var cell = '<div class="site-card">';
         cell += '<a class="card-link" target="_blank" rel="external noopener noreferrer" href="' + item.url + '">';
-        cell += '<img alt="' + item.title + '" src="' + (item.screenshot || ('https://image.thum.io/get/width/1024/crop/768/' + item.url)) + '" onerror="javascript:this.onerror=null;this.src=\'' + cfg.screenshot + '\';"/>';
+        cell += '<img alt="' + item.title + '" src="' + (item.screenshot || ('https://image.thum.io/get/width/1024/crop/768/' + item.url)) + '" onerror="errorImgCover(this)"/>';
         cell += '<div class="info">';
-        cell += '<img alt="' + item.title + '" src="' + (item.avatar || cfg.avatar) + '" onerror="javascript:this.onerror=null;this.src=\'' + cfg.avatar + '\';"/>';
+        cell += '<img alt="' + item.title + '" src="' + (item.avatar || cfg.avatar) + '" onerror="errorImgAvatar(this)"/>';
         cell += '<span class="title">' + item.title + '</span>';
         cell += '<span class="desc">' + (item.description || item.url) + '</span>';
         cell += '</div>';