oscar and simple themes: no inline script (allow A+ Content-Security-Policy)

searx/static/themes/oscar/js/searx_src/01_init.js

+/**
+ * searx is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * searx is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with searx. If not, see < http://www.gnu.org/licenses/ >.
+ *
+ * (C) 2019 by Alexandre Flament
+ */
+window.searx = (function(d) {
+    'use strict';
+
+    // add data- properties
+    var script = d.currentScript  || (function() {
+        var scripts = d.getElementsByTagName('script');
+        return scripts[scripts.length - 1];
+    })();
+
+    return {
+        autocompleter: script.getAttribute('data-autocompleter') === 'true',
+        method: script.getAttribute('data-method')
+    };
+})(document);

searx/static/themes/simple/css/searx-rtl.css

-/*! searx | 28-05-2019 | https://github.com/asciimoo/searx */
+/*! searx | 06-08-2019 | https://github.com/asciimoo/searx */
 /*
 * searx, A privacy-respecting, hackable metasearch engine
 *

searx/static/themes/simple/css/searx.css

-/*! searx | 28-05-2019 | https://github.com/asciimoo/searx */
+/*! searx | 06-08-2019 | https://github.com/asciimoo/searx */
 /*
 * searx, A privacy-respecting, hackable metasearch engine
 *

searx/static/themes/simple/gruntfile.js

@@ -10,21 +10,36 @@ module.exports = function(grunt) {
         tasks: ['jshint', 'concat', 'uglify', 'webfont', 'less:development', 'less:production']
       }
     },
-    concat: {
+    jshint: {
+      files: ['js/searx_src/*.js', 'js/searx_header/*.js'],
       options: {
-        separator: ';'
-      },
-      dist: {
-        src: ['js/searx_src/*.js'],
-        dest: 'js/searx.js'
+        reporterOutput: "",
+        proto: true,
+        // options here to override JSHint defaults
+        globals: {
+          browser: true,
+          jQuery: false,
+          devel: true
+        }
+      }
+    },
+    concat: {
+      head_and_body: {
+        options: {
+          separator: ';'
+        },
+        files: {
+          'js/searx.head.js': ['js/searx_head/*.js'],
+          'js/searx.js': ['js/searx_src/*.js']
+        }
       }
     },
     uglify: {
       options: {
         banner: '/*! simple/searx.min.js | <%= grunt.template.today("dd-mm-yyyy") %> | https://github.com/asciimoo/searx */\n',
-	output: {
-	    comments: 'some'
-	},
+        output: {
+	        comments: 'some'
+        },
         ie8: false,
         warnings: true,
         compress: false,
@@ -33,20 +48,8 @@ module.exports = function(grunt) {
       },
       dist: {
         files: {
-          'js/searx.min.js': ['<%= concat.dist.dest %>']
-        }
-      }
-    },
-    jshint: {
-      files: ['js/searx_src/*.js'],
-      options: {
-        reporterOutput: "",
-        proto: true,
-        // options here to override JSHint defaults
-        globals: {
-          browser: true,
-          jQuery: false,
-          devel: true
+          'js/searx.head.min.js': ['js/searx.head.js'],
+          'js/searx.min.js': ['js/searx.js']
         }
       }
     },

searx/static/themes/simple/js/searx.head.js

+/**
+* searx is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Affero General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* searx is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU Affero General Public License for more details.
+*
+* You should have received a copy of the GNU Affero General Public License
+* along with searx. If not, see < http://www.gnu.org/licenses/ >.
+*
+* (C) 2019 by Alexandre Flament
+*
+*/
+(function(w, d) {
+    'use strict';
+
+    // add data- properties
+    var script = d.currentScript  || (function() {
+        var scripts = d.getElementsByTagName('script');
+        return scripts[scripts.length - 1];
+    })();
+
+    // try to detect touch screen
+    w.searx = {
+        touch: (("ontouchstart" in w) || w.DocumentTouch && document instanceof DocumentTouch) || false,
+        method: script.getAttribute('data-method'),
+        autocompleter: script.getAttribute('data-autocompleter') === 'true',
+        search_on_category_select: script.getAttribute('data-search-on-category-select') === 'true',
+        infinite_scroll: script.getAttribute('data-infinite-scroll') === 'true',
+        static_path: script.getAttribute('data-static-path'),
+        no_item_found: script.getAttribute('data-no-item-found')
+    }
+
+    // update the css
+    d.getElementsByTagName("html")[0].className = (w.searx.touch)?"js touch":"js";
+})(window, document);
\ No newline at end of file

searx/static/themes/simple/js/searx.head.min.js

+/*! simple/searx.min.js | 06-08-2019 | https://github.com/asciimoo/searx */
+
+(function(t,e){"use strict";var a=e.currentScript||function(){var t=e.getElementsByTagName("script");return t[t.length-1]}();t.searx={touch:"ontouchstart"in t||t.DocumentTouch&&document instanceof DocumentTouch||false,method:a.getAttribute("data-method"),autocompleter:a.getAttribute("data-autocompleter")==="true",search_on_category_select:a.getAttribute("data-search-on-category-select")==="true",infinite_scroll:a.getAttribute("data-infinite-scroll")==="true",static_path:a.getAttribute("data-static-path"),no_item_found:a.getAttribute("data-no-item-found")};e.getElementsByTagName("html")[0].className=t.searx.touch?"js touch":"js"})(window,document);
+//# sourceMappingURL=searx.head.min.js.map
\ No newline at end of file

searx/static/themes/simple/js/searx.head.min.js.map

+{"version":3,"sources":["searx.head.js"],"names":["w","d","script","currentScript","scripts","getElementsByTagName","length","searx","touch","DocumentTouch","document","method","getAttribute","autocompleter","search_on_category_select","infinite_scroll","static_path","no_item_found","className","window"],"mappings":";;CAiBA,SAAUA,EAAGC,GACT,aAGA,IAAIC,EAASD,EAAEE,eAAkB,WAC7B,IAAIC,EAAUH,EAAEI,qBAAqB,UACrC,OAAOD,EAAQA,EAAQE,OAAS,GAFH,GAMjCN,EAAEO,MAAQ,CACNC,MAAS,iBAAkBR,GAAMA,EAAES,eAAiBC,oBAAoBD,eAAkB,MAC1FE,OAAQT,EAAOU,aAAa,eAC5BC,cAAeX,EAAOU,aAAa,wBAA0B,OAC7DE,0BAA2BZ,EAAOU,aAAa,oCAAsC,OACrFG,gBAAiBb,EAAOU,aAAa,0BAA4B,OACjEI,YAAad,EAAOU,aAAa,oBACjCK,cAAef,EAAOU,aAAa,uBAIvCX,EAAEI,qBAAqB,QAAQ,GAAGa,UAAalB,EAAEO,MAAW,MAAE,WAAW,MArB7E,CAsBGY,OAAQT","file":"searx.head.min.js"}
\ No newline at end of file

searx/static/themes/simple/js/searx.js

@@ -15,7 +15,7 @@
 * (C) 2017 by Alexandre Flament, <alex@al-f.net>
 *
 */
-(function(w, d, searx) {
+window.searx = (function(w, d) {
 
   'use strict';
 
@@ -45,7 +45,7 @@
     }
   }
 
-  searx = searx || {};
+  var searx = window.searx || {};
 
   searx.on = function(obj, eventType, callback, useCapture) {
     useCapture = useCapture || false;
@@ -110,7 +110,7 @@
   };
 
   searx.loadStyle = function(src) {
-    var path = searx.staticPath + src,
+    var path = searx.static_path + src,
     id = "style_" + src.replace('.', '_'),
     s = d.getElementById(id);
     if (s === null) {
@@ -124,7 +124,7 @@
   };
 
   searx.loadScript = function(src, callback) {
-    var path = searx.staticPath + src,
+    var path = searx.static_path + src,
     id = "script_" + src.replace('.', '_'),
     s = d.getElementById(id);
     if (s === null) {
@@ -161,7 +161,7 @@
   });
   
   return searx;
-})(window, document, window.searx);
+})(window, document);
 ;(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.AutoComplete = f()}})(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
 /*
  * @license MIT
@@ -1529,7 +1529,7 @@ module.exports = AutoComplete;
       if (searx.autocompleter) {
         searx.autocomplete = AutoComplete.call(w, {
           Url: "./autocompleter",
-          EmptyMessage: searx.noItemFound,
+          EmptyMessage: searx.no_item_found,
           HttpMethod: searx.method,
           MinChars: 4,
           Delay: 300,

searx/static/themes/simple/js/searx_head/00_init.js

+/**
+* searx is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Affero General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* searx is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU Affero General Public License for more details.
+*
+* You should have received a copy of the GNU Affero General Public License
+* along with searx. If not, see < http://www.gnu.org/licenses/ >.
+*
+* (C) 2019 by Alexandre Flament
+*
+*/
+(function(w, d) {
+    'use strict';
+
+    // add data- properties
+    var script = d.currentScript  || (function() {
+        var scripts = d.getElementsByTagName('script');
+        return scripts[scripts.length - 1];
+    })();
+
+    // try to detect touch screen
+    w.searx = {
+        touch: (("ontouchstart" in w) || w.DocumentTouch && document instanceof DocumentTouch) || false,
+        method: script.getAttribute('data-method'),
+        autocompleter: script.getAttribute('data-autocompleter') === 'true',
+        search_on_category_select: script.getAttribute('data-search-on-category-select') === 'true',
+        infinite_scroll: script.getAttribute('data-infinite-scroll') === 'true',
+        static_path: script.getAttribute('data-static-path'),
+        no_item_found: script.getAttribute('data-no-item-found')
+    }
+
+    // update the css
+    d.getElementsByTagName("html")[0].className = (w.searx.touch)?"js touch":"js";
+})(window, document);
\ No newline at end of file

searx/static/themes/simple/js/searx_src/00_searx_toolkit.js

@@ -15,7 +15,7 @@
 * (C) 2017 by Alexandre Flament, <alex@al-f.net>
 *
 */
-(function(w, d, searx) {
+window.searx = (function(w, d) {
 
   'use strict';
 
@@ -45,7 +45,7 @@
     }
   }
 
-  searx = searx || {};
+  var searx = window.searx || {};
 
   searx.on = function(obj, eventType, callback, useCapture) {
     useCapture = useCapture || false;
@@ -110,7 +110,7 @@
   };
 
   searx.loadStyle = function(src) {
-    var path = searx.staticPath + src,
+    var path = searx.static_path + src,
     id = "style_" + src.replace('.', '_'),
     s = d.getElementById(id);
     if (s === null) {
@@ -124,7 +124,7 @@
   };
 
   searx.loadScript = function(src, callback) {
-    var path = searx.staticPath + src,
+    var path = searx.static_path + src,
     id = "script_" + src.replace('.', '_'),
     s = d.getElementById(id);
     if (s === null) {
@@ -161,4 +161,4 @@
   });
   
   return searx;
-})(window, document, window.searx);
+})(window, document);

searx/static/themes/simple/js/searx_src/searx_search.js

@@ -73,7 +73,7 @@
       if (searx.autocompleter) {
         searx.autocomplete = AutoComplete.call(w, {
           Url: "./autocompleter",
-          EmptyMessage: searx.noItemFound,
+          EmptyMessage: searx.no_item_found,
           HttpMethod: searx.method,
           MinChars: 4,
           Delay: 300,

searx/templates/oscar/base.html

@@ -37,12 +37,6 @@
     {% endblock %}
 
     <link title="{{ instance_name }}" type="application/opensearchdescription+xml" rel="search" href="{{ url_for('opensearch') }}"/>
-
-    <script type="text/javascript">
-        searx = {};
-        searx.method = "{{ method or 'POST' }}";
-        searx.autocompleter = {% if autocomplete %}true{% else %}false{% endif %};
-    </script>
     <noscript>
         <style type="text/css">
             .tab-content > .active_if_nojs, .active_if_nojs {display: block !important; visibility: visible !important;}
@@ -101,7 +95,9 @@
     <script src="{{ url_for('static', filename='js/bootstrap.min.js') }}"></script>
     {% if autocomplete %}<script src="{{ url_for('static', filename='js/typeahead.bundle.min.js') }}"></script>{% endif %}
     <script src="{{ url_for('static', filename='js/require-2.1.15.min.js') }}"></script>
-    <script src="{{ url_for('static', filename='js/searx.min.js') }}"></script>
+    <script src="{{ url_for('static', filename='js/searx.min.js') }}"
+            data-method="{{ method or 'POST' }}"
+            data-autocompleter="{% if autocomplete %}true{% else %}false{% endif %}"></script>
     {% for script in scripts %}
         <script src="{{ url_for('static', filename=script) }}"></script>
     {% endfor %}

searx/templates/simple/base.html

@@ -11,29 +11,26 @@
   <meta name="HandheldFriendly" content="True">
   <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1">
   <title>{% block title %}{% endblock %}{{ instance_name }}</title>
+  {% block meta %}{% endblock %}
   {% if rtl %}
   <link rel="stylesheet" href="{{ url_for('static', filename='css/searx-rtl.min.css') }}" type="text/css" media="screen" />
   {% else %}
   <link rel="stylesheet" href="{{ url_for('static', filename='css/searx.min.css') }}" type="text/css" media="screen" />
   {% endif %}
   {% block styles %}{% endblock %}
-  {% block meta %}{% endblock %}
+  <!--[if gte IE 9]>-->
+  <script src="{{ url_for('static', filename='js/searx.head.min.js') }}"
+          data-method="{{ method or 'POST' }}"
+          data-autocompleter="{% if autocomplete %}true{% else %}false{% endif %}"
+          data-search-on-category-select="{{ 'true' if 'plugins/js/search_on_category_select.js' in scripts else 'false'}}"
+          data-infinite-scroll="{{ 'true' if 'plugins/js/infinite_scroll.js' in scripts else 'false' }}"
+          data-static-path="{{ url_for('static', filename='themes/simple') }}/"
+          data-no-item-found="{{ _('No item found') }}"></script>
+  <!--<![endif]-->
   {% block head %}
   <link title="{{ instance_name }}" type="application/opensearchdescription+xml" rel="search" href="{{ url_for('opensearch') }}"/>
   {% endblock %}
   <link rel="shortcut icon" href="{{ url_for('static', filename='img/favicon.png') }}" />
-  <script type="text/javascript">
-    var searx = {
-      autocompleter: {% if autocomplete %}true{% else %}false{% endif %},
-      method: "{{ method or 'POST' }}",
-      touch: (("ontouchstart" in window) || window.DocumentTouch && document instanceof DocumentTouch) || false,
-      staticPath: "{{ url_for('static', filename='themes/simple') }}/",
-      noItemFound: "{{ _('No item found') }}",
-      search_on_category_select: {{ 'true' if 'plugins/js/search_on_category_select.js' in scripts else 'false'}},
-      infinite_scroll: {{ 'true' if 'plugins/js/infinite_scroll.js' in scripts else 'false' }}
-    };
-    document.getElementsByTagName("html")[0].className = (searx.touch)?"js touch":"js";
-  </script>
 </head>
 <body>
   <main id="main_{{  self._TemplateReference__context.name|replace("simple/", "")|replace(".html", "") }}">
@@ -60,7 +57,7 @@
     </p>
   </footer>
   <!--[if gte IE 9]>-->
-  <script src="{{ url_for('static', filename='js/searx.min.js') }}" ></script>
+  <script src="{{ url_for('static', filename='js/searx.min.js') }}"></script>
   <!--<![endif]-->
 </body>
 </html>