From dd00e9d279350e728b9457b8cdbf1019a706c644 Mon Sep 17 00:00:00 2001
From: Pierre Rudloff <contact@rudloff.pro>
Date: Mon, 3 Jul 2017 10:17:37 +0200
Subject: [PATCH 1/3] Remove Google Cast support since the JS library does not
 seem to be maintained anymore and it frequently breaks

---
 Gruntfile.js                               |   6 +-
 css/style.css                              |  12 ---
 img/ic_media_route_disabled_holo_light.png | Bin 380 -> 0 bytes
 img/ic_media_route_off_holo_light.png      | Bin 401 -> 0 bytes
 img/ic_media_route_on_holo_light.png       | Bin 439 -> 0 bytes
 js/cast.js                                 | 109 ---------------------
 templates/inc/footer.tpl                   |   1 -
 templates/inc/head.tpl                     |   1 -
 templates/video.tpl                        |   2 -
 9 files changed, 3 insertions(+), 128 deletions(-)
 delete mode 100644 img/ic_media_route_disabled_holo_light.png
 delete mode 100644 img/ic_media_route_off_holo_light.png
 delete mode 100644 img/ic_media_route_on_holo_light.png
 delete mode 100644 js/cast.js

diff --git a/Gruntfile.js b/Gruntfile.js
index ea379ad..01d1704 100644
--- a/Gruntfile.js
+++ b/Gruntfile.js
@@ -11,7 +11,7 @@ module.exports = function (grunt) {
             uglify: {
                 combine: {
                     files: {
-                        'dist/main.js': ['js/cast.js']
+                        'dist/main.js': ['js/*.js']
                     }
                 }
             },
@@ -128,8 +128,8 @@ module.exports = function (grunt) {
     grunt.loadNpmTasks('grunt-potomo');
     grunt.loadNpmTasks('grunt-contrib-csslint');
 
-    grunt.registerTask('default', ['uglify', 'cssmin', 'potomo']);
-    grunt.registerTask('lint', ['jslint', 'csslint', 'fixpack', 'jsonlint', 'phpcs']);
+    grunt.registerTask('default', ['cssmin', 'potomo']);
+    grunt.registerTask('lint', ['csslint', 'fixpack', 'jsonlint', 'phpcs']);
     grunt.registerTask('test', ['phpunit']);
     grunt.registerTask('doc', ['phpdocumentor']);
     grunt.registerTask('release', ['default', 'githash', 'compress']);
diff --git a/css/style.css b/css/style.css
index eb886dc..6acce45 100644
--- a/css/style.css
+++ b/css/style.css
@@ -544,18 +544,6 @@ h1 {
     max-width:700px;
 }
 
-.cast_btn {
-    cursor:pointer;
-}
-
-.cast_hidden {
-    display:none;
-}
-
-.cast_icon {
-    vertical-align:middle;
-}
-
 .format {
     text-align:left;
 }
diff --git a/img/ic_media_route_disabled_holo_light.png b/img/ic_media_route_disabled_holo_light.png
deleted file mode 100644
index 319c57e8f343f22b12799ab91937eac20ca6eb80..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 380
zcmV-?0fYXDP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBUz9!W$&RCwC#*TGA|U>L{ot;E?S6hQ`J
zR3c>RCCH0(>C~m`{>WYJ67&az5_kw16V!u;Li1RH=KKzxLx%>@*j^9s3m;yX41e#l
z=b2~*L13s{2ZrLM1Ly$C17v=?=s3=OQeWu0Zg>AH@MCrVdCEUmRX3py5Y>dwC@QG{
z-D<O~;Hj#>wd`M*VuJ59dtih)EYxueJGB73L_Fz%Cpo<(RjH=c19xm!IKnG>*x(YC
zw8pTE8#Lr`^sz+?xugR;;zcIm98E0X;}91~Pr;dV|5B=Oig%19P*|NI3TQ|CoX4s_
zSoRLq7|6AnjN+TzQ^E&=Bq|WDeAx9&gwJU{<+NFO6el?5vl;tC+yJKjW1<7-0ICD*
a1Q-BA!9d^IFiXz>0000<MNUMnLSTYhO{8@I

diff --git a/img/ic_media_route_off_holo_light.png b/img/ic_media_route_off_holo_light.png
deleted file mode 100644
index b74cdb5b1a93fc5adaf09bb4297cb7e13ebee15b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 401
zcmV;C0dD?@P)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBUzGf6~2RCwC#)-g+hK^(_%AB`4Q!3uf}
zE;+b3N(hlH4~mnZgP@Bjh=GI@Es26}K^&f`RtFWF+}i?akQ`csh9Ic(`@oGxirjMz
zckto=@F?8x`QP26mJq_HbNGFlhY4T;Xb*6(>85Sl%Fd?aIM)B~z^1fxW#74k*@Py*
zE}JlcxRwsE+b=0^XzE&mM?B+|Fm(jI4seGdj&Y9{LZnm$uzveT#H2@*YZPVB8ru85
zi2i&PGw})oE>HP#nR<Z_JRs-A5_}_r89~}|Ij-=99!^vT2qTRpD(<9oVnn@xyCH8?
z2PokQQ7qg&Kqr#aF5ZzvNG^@o!PWsfm|}&zyw|{|Jfep<#~44V-h^kU()t!pKj%6o
vpL&7<B7D}T29zB`^J{1Vm;hdlwEzPEIu==ZdQ?AO00000NkvXXu0mjf+771-

diff --git a/img/ic_media_route_on_holo_light.png b/img/ic_media_route_on_holo_light.png
deleted file mode 100644
index c49f2d09148e6ef760a3d5144368eb98120c49a2..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 439
zcmV;o0Z9IdP)<h;3K|Lk000e1NJLTq001BW001Be1^@s6b9#F80000PbVXQnQ*UN;
zcVTj606}DLVr3vnZDD6+Qe|Oed2z{QJOBUzSxH1eRCwC#*1t;vVI0SC&q|1fAcE3r
zZ4JVurM3uv;My8g&=5srh(bgZErnQ%e}FhkLxMv^O+i}@LKL;s6bKCsf{*Wm@6eEN
zr`;XGbMWG;ck1)G?{oK@hEmGs<!0yrI)D!FSAg)<hhwQ8BO&AWd%w@)t>0=|y3*}f
z%65Q%oDQSi0nevE2WWQ<EMnf14sg*WDCQ-<FS{ama&rnwsN#(<De4_&aqd=tV^k2t
z37!$d7S_>p<ypYlk5e+(kf2GNVH?>F)&XT{DQ4h0ioBfS!<*DNzHy2b<WP330}TE}
z8Ii>1neJgh25n#(gQ!_qNo{w4Z4Ar!#11a_(lzw}LpZ_<2IPmWu+;%`j`Pxm2TUT0
z8@yu}6PUxL6OUuF?f0l-RraOvBe!S(OA@H*)Jhn}E@=<x$g7;~C~mQa8IBdGefmG4
h4xj_{e1Mh!0|1VkiTi;nJs<!8002ovPDHLkV1iuwzz_fc

diff --git a/js/cast.js b/js/cast.js
deleted file mode 100644
index f693a92..0000000
--- a/js/cast.js
+++ /dev/null
@@ -1,109 +0,0 @@
-/*global chrome*/
-/*jslint browser: true, nomen: true */
-var castModule = (function () {
-    'use strict';
-    var launchBtn, disabledBtn, stopBtn, session;
-
-    function receiverListener(e) {
-        return (e === chrome.cast.ReceiverAvailability.AVAILABLE);
-    }
-
-    function onMediaDiscovered() {
-        if (launchBtn) {
-            stopBtn.classList.remove('cast_hidden');
-            launchBtn.classList.add('cast_hidden');
-        }
-    }
-
-    function onStopCast() {
-        stopBtn.classList.add('cast_hidden');
-        launchBtn.classList.remove('cast_hidden');
-    }
-
-    function onStopCastError(e) {
-        onStopCast();
-        throw e.description;
-    }
-
-    function updateListener() {
-        if (session.status !== chrome.cast.SessionStatus.CONNECTED) {
-            onStopCast();
-        }
-    }
-
-    function sessionListener(e) {
-        session = e;
-        session.addMediaListener(onMediaDiscovered);
-        session.addUpdateListener(updateListener);
-        if (session.media.length !== 0) {
-            onMediaDiscovered();
-        }
-    }
-
-    function stopCast() {
-        session.stop(onStopCast, onStopCastError);
-    }
-
-    function onMediaError(e) {
-        stopCast();
-        throw e.description;
-    }
-
-    function onRequestSessionSuccess(e) {
-        session = e;
-        var videoLink = document.getElementById('video_link'), videoURL = videoLink.dataset.video, mediaInfo = new chrome.cast.media.MediaInfo(videoURL, 'video/' + videoLink.dataset.ext), request = new chrome.cast.media.LoadRequest(mediaInfo);
-        session.loadMedia(request, onMediaDiscovered, onMediaError);
-    }
-
-    function onLaunchError(e) {
-        throw e.description;
-    }
-
-    function launchCast() {
-        chrome.cast.requestSession(onRequestSessionSuccess, onLaunchError);
-    }
-
-    function onInitSuccess() {
-        launchBtn = document.getElementById('cast_btn_launch');
-        disabledBtn = document.getElementById('cast_disabled');
-        stopBtn = document.getElementById('cast_btn_stop');
-        if (launchBtn) {
-            disabledBtn.classList.add('cast_hidden');
-            launchBtn.classList.remove('cast_hidden');
-            launchBtn.addEventListener('click', launchCast, false);
-            stopBtn.addEventListener('click', stopCast, false);
-        }
-    }
-
-    function onError(e) {
-        throw e.code;
-    }
-
-    function initializeCastApi() {
-        var sessionRequest = new chrome.cast.SessionRequest(chrome.cast.media.DEFAULT_MEDIA_RECEIVER_APP_ID),
-            apiConfig = new chrome.cast.ApiConfig(sessionRequest, sessionListener, receiverListener, chrome.cast.AutoJoinPolicy.ORIGIN_SCOPED);
-        chrome.cast.initialize(apiConfig, onInitSuccess, onError);
-    }
-
-    function loadCastApi(loaded, errorInfo) {
-        if (loaded) {
-            initializeCastApi();
-        } else {
-            throw errorInfo;
-        }
-    }
-
-    return {
-        init: function () {
-            var intro = document.getElementById('download_intro');
-            if (intro) {
-                intro.insertAdjacentHTML('beforeend', '<img class="cast_icon" id="cast_disabled" src="img/ic_media_route_disabled_holo_light.png" alt="" title="Google Cast is not supported on this browser." /> <img class="cast_btn cast_hidden cast_icon" id="cast_btn_launch" src="img/ic_media_route_off_holo_light.png" title="Cast to ChromeCast" alt="Google Cast™" /> <img src="img/ic_media_route_on_holo_light.png" alt="Casting to ChromeCast…" title="Stop casting" id="cast_btn_stop" class="cast_btn cast_hidden cast_icon" />');
-                window.__onGCastApiAvailable = loadCastApi;
-            }
-        }
-    };
-}());
-
-if (typeof window === 'object') {
-    window.addEventListener('load', castModule.init, false);
-}
diff --git a/templates/inc/footer.tpl b/templates/inc/footer.tpl
index bcc7eb8..1bca78f 100644
--- a/templates/inc/footer.tpl
+++ b/templates/inc/footer.tpl
@@ -16,6 +16,5 @@
      {t}Based on{/t} <a href="http://rg3.github.io/youtube-dl/">youtube-dl</a>
      </div>
 </footer>
-<script src="{base_url}/dist/main.js"></script>
 </body>
 </html>
diff --git a/templates/inc/head.tpl b/templates/inc/head.tpl
index 16e185f..3524870 100644
--- a/templates/inc/head.tpl
+++ b/templates/inc/head.tpl
@@ -19,7 +19,6 @@
 <meta name="twitter:title" content="AllTube Download{if isset($title)} - {$title|escape}{/if}" />
 <meta name="twitter:image" content="{base_url}/img/logo.png" />
 <meta name="twitter:creator" content="@Tael67" />
-<script type="text/javascript" src="https://www.gstatic.com/cv/js/sender/v1/cast_sender.js"></script>
 <meta name="theme-color" content="#4F4F4F">
 <link rel="manifest" href="{base_url}/resources/manifest.json" />
 </head>
diff --git a/templates/video.tpl b/templates/video.tpl
index 6abf0ba..12797f6 100644
--- a/templates/video.tpl
+++ b/templates/video.tpl
@@ -5,8 +5,6 @@
 {include file="inc/logo.tpl"}
 <p id="download_intro">{t}You are going to download{/t}<i itemprop="name">
     <a itemprop="url" id="video_link"
-        data-ext="{$video->ext}"
-        data-video="{$video->url|escape}"
         href="{$video->webpage_url}">
 {$video->title}</a></i>.
 </p>

From 59e5df4aa65e82758a37e1524fc41573d2ff8813 Mon Sep 17 00:00:00 2001
From: Pierre Rudloff <contact@rudloff.pro>
Date: Mon, 3 Jul 2017 10:19:20 +0200
Subject: [PATCH 2/3] Content-Security-Policy and other security headers

---
 .htaccess | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.htaccess b/.htaccess
index 6487a7c..ca8ae0c 100644
--- a/.htaccess
+++ b/.htaccess
@@ -28,3 +28,10 @@ FileETag None
 <ifmodule mod_filter.c>
     AddOutputFilterByType DEFLATE text/css text/html application/javascript font/truetype
 </ifmodule>
+
+<ifmodule mod_headers.c>
+    Header set X-Frame-Options DENY
+    Header set X-Content-Type-Options nosniff
+    Header set X-XSS-Protection "1; mode=block"
+    Header set Content-Security-Policy "default-src 'self'; object-src 'none'; script-src 'none'; img-src http:"
+</ifmodule>

From b4f0cf7a38a94a4e67e05ed8a11e2736e56d7940 Mon Sep 17 00:00:00 2001
From: Pierre Rudloff <contact@rudloff.pro>
Date: Mon, 3 Jul 2017 10:35:28 +0200
Subject: [PATCH 3/3] Use HttpOnly session cookies

---
 classes/LocaleManager.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/classes/LocaleManager.php b/classes/LocaleManager.php
index d822588..9c9ce9d 100644
--- a/classes/LocaleManager.php
+++ b/classes/LocaleManager.php
@@ -40,6 +40,7 @@ class LocaleManager
     {
         $session_factory = new \Aura\Session\SessionFactory();
         $session = $session_factory->newInstance($cookies);
+        $session->setCookieParams(['httponly' => true]);
         $this->sessionSegment = $session->getSegment('Alltube\LocaleManager');
         $cookieLocale = $this->sessionSegment->get('locale');
         if (isset($cookieLocale)) {