yakuza0 2.22.8 → 2.22.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.8",
+  "version": "2.22.9",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -174,7 +174,7 @@ exports.default = function () {
   var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee13(_ref2) {
     var app = _ref2.app,
         config = _ref2.config;
-    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, clnInitCache, cm;
+    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, helmetOptions, clnInitCache, cm;
     return _regenerator2.default.wrap(function _callee13$(_context13) {
       while (1) {
         switch (_context13.prev = _context13.next) {
@@ -269,10 +269,18 @@ exports.default = function () {
             // const browsers = Object.keys(yConf.allowBrowsers);
 
             if (_config2.default.security.helmet) {
-              app.use((0, _koaHelmet2.default)({
-                referrerPolicy: { policy: "no-referrer-when-downgrade" }
+              helmetOptions = {
+                // referrerPolicy: { policy: "no-referrer-when-downgrade" },
+                // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
+                // referrerPolicy: yConf.stupid.referrerPolicy.policy,
                 // referrerPolicy: { policy: "origin-when-crossorigin" },
-              }));
+              };
+
+              if (_config2.default.security.isStupid) {
+                helmetOptions.referrerPolicy = _config2.default.server.stupid.referrerPolicy;
+              }
+
+              app.use((0, _koaHelmet2.default)(helmetOptions));
             }
 
             // if (!yConf.security.helmet || yConf.server.ddos.enabled) {

package/utils/inclusive.js

@@ -501,6 +501,9 @@ var render = function () {
                     // secretKey: '', // check this from acm console
                     requestTimeout: 6000 // timeout(ms)，default 6s
                   }
+                },
+                stupid: {
+                  referrerPolicy: { policy: "strict-origin-when-cross-origin" }
                 }
               },
               extend: {