From 9d3c700b796cc80f9c73a0e75b5f2425250ed4c0 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 19:17:47 +0100
Subject: [PATCH 01/11] Add user-defined CORS-settings for script files

---
 core/js.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/js.php b/core/js.php
index c344399..f779c64 100644
--- a/core/js.php
+++ b/core/js.php
@@ -4,6 +4,7 @@
 
 use Asset;
 use f;
+use c;
 use html;
 
 class JS extends \Kirby\Component\JS {
@@ -51,7 +52,7 @@ public function tag($src, $async = false) {
     $attr = array(
       'src' => url($src),
       'integrity' => $jsIntegrity, // inject generated sri hash
-      'crossorigin' => 'anonymous'
+      'crossorigin' => c::get('sri-hash.use-credentials') ? 'use-credentials' : 'anonymous' // set user-defined 'crossorigin' attribute
     );
 
     if(is_array($async)) {

From 738a768e4cc122a7a02bc073f265efecd93b007e Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 19:20:22 +0100
Subject: [PATCH 02/11] Add user-defined CORS-settings for style files

---
 core/css.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/css.php b/core/css.php
index cd37b8c..59d8c32 100644
--- a/core/css.php
+++ b/core/css.php
@@ -4,6 +4,7 @@
 
 use Asset;
 use f;
+use c;
 use html;
 
 class CSS extends \Kirby\Component\CSS {
@@ -52,7 +53,7 @@ public function tag($url, $media = null) {
       'rel'  => 'stylesheet',
       'href' => url($url),
       'integrity' => $cssIntegrity, // inject generated sri hash
-      'crossorigin' => 'anonymous'
+      'crossorigin' => c::get('sri-hash.use-credentials') ? 'use-credentials' : 'anonymous' // set user-defined 'crossorigin' attribute
     );
 
     if(is_array($media)) {

From aa1fca69489610862361077bc693b353c73e2bab Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 19:22:21 +0100
Subject: [PATCH 03/11] Update kirby-sri.php

---
 kirby-sri.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kirby-sri.php b/kirby-sri.php
index 835c0df..092f2d6 100644
--- a/kirby-sri.php
+++ b/kirby-sri.php
@@ -3,7 +3,7 @@
 /**
  * Adding SRI Hash to css & js files and cache-busting them
  *
- * @version 0.1.0
+ * @version 0.3.0
  * @author S1SYPHOS <hello@twobrain.io>
  */
 

From 76632e9129d43bf465861a8a9832f84875b191c7 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 19:24:02 +0100
Subject: [PATCH 04/11] Update package.json

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 44c58ed..f1f3066 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "sri-hash",
   "description": "Kirby SRI Hash & Cache-bust Plugin",
   "author": "S1SYPHOS <hello@twobrain.io>",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "kirby-plugin",
   "license": "MIT"
 }

From f2fa3ef9a311b4a89761febced0ef338dd797d7a Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 20:18:39 +0100
Subject: [PATCH 05/11] Added section 'Options'

---
 README.md | 49 +++++++++++++++++++++++++++++++++++++------------
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/README.md b/README.md
index a29540d..691cfc7 100644
--- a/README.md
+++ b/README.md
@@ -1,22 +1,36 @@
 # kirby-sri
-This plugin generates base64-encoded cryptographic hashes for your css / js files based on their content and adds them to the `integrity` attribute of their corresponding `<script>` or `<link>` elements.
+This plugin generates base64-encoded cryptographic hashes for your css / js files based on their content and adds them to the `integrity` attribute of their corresponding `<link>` or `<script>` elements.
 
 `kirby-sri` also applies [cache-busting / fingerprinting](#cache-busting--fingerprinting).
 
 ![screenshot of the kirby-sri plugin](screenshot.png)
 
+**Table of contents**
+- [1. What's SRI?](#whats-sri)
+- [2. Installation](#installation)
+  - [a) Git submodule](#git-submodule)
+  - [b) Clone or download](#clone-or-download)
+- [3. Usage](#usage)
+  - [a) Activation](#activation)
+  - [b) Options](#options)
+- [4. Cachebusting / fingerprinting](#cache-busting--fingerprinting)
+  - [a) Apache](#apache)
+  - [b) NGINX](#nginx)
+- [4. Be safe - use protection!](#be-safe---use-protection)
+- [5. Credits / License](#credits--license)
+
 ## What's SRI?
 > Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.
 > [Mozilla Developer Network](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)
 
 Enter `kirby-sri`: Kirby-side generated SRI hashes for [safer CDN usage](https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/). Read more about CDN integration and Kirby in the [docs](https://getkirby.com/docs/cookbook/kirby-loves-cdn)) or over at Kirby's partner [KeyCDN](https://www.keycdn.com/support/kirby-cdn-integration/) to get started.
 
-**This plugin only provides hash generation. For usage with CDNs, refer to Kirby's official [`cdn-plugin`](https://github.com/getkirby-plugins/cdn-plugin)!**
+**This plugin only provides hash generation.** For usage with CDNs, refer to Kirby's official [`cdn-plugin`](https://github.com/getkirby-plugins/cdn-plugin)!
 
 ## Installation
 Use one of the following methods to install & use `kirby-sri`:
 
-### 1. Git Submodule
+### Git submodule
 
 If you know your way around Git, you can download this plugin as a [submodule](https://github.com/blog/2104-working-with-submodules):
 
@@ -24,12 +38,15 @@ If you know your way around Git, you can download this plugin as a [submodule](h
 git submodule add https://github.com/S1SYPHOS/kirby-sri.git site/plugins/kirby-sri
 ```
 
-### 2. Clone or download
+### Clone or download
 
 1. [Clone](https://github.com/S1SYPHOS/kirby-sri.git) or [download](https://github.com/S1SYPHOS/kirby-sri/archive/master.zip)  this repository.
 2. Unzip / Move the folder to `site/plugins`.
 
-### 3. Activate the plugin
+## Usage
+After installing the plugin, you should activate it (if you haven't already, read about [multi-environment setups](https://getkirby.com/docs/developer-guide/configuration/options)) and have a look at its options.
+
+### Activation
 Activate the plugin with the following line in your `config.php`:
 
 ```text
@@ -38,15 +55,17 @@ c::set('sri-hash', true);
 
 Kirby's built-in helper functions `css()` and `js()` will now include the `integrity` attribute alongside a matching SRI hash.
 
-**Always use https:// URLs when loading subresources from a CDN, otherwise they might get blocked:**
+### Options
+You may configure `kirby-sri` to suit your needs with the following options:
 
-> Mixed content occurs when initial HTML is loaded over a secure HTTPS connection, but other resources (such as images, videos, stylesheets, scripts) are loaded over an insecure HTTP connection. This is called mixed content because both HTTP and HTTPS content are being loaded to display the same page, and the initial request was secure over HTTPS. Modern browsers display warnings about this type of content to indicate to the user that this page contains insecure resources.
-> [Google Developers](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content)
+| Option | Type | Default | Description |
+| --- | --- | --- | --- |
+| `sri-hash.use-credentials` | Boolean | `false` | Sets `crossorigin` attribute to `use-credentials` (default: `anonymous`). |
 
 ## Cache-busting / Fingerprinting
 [Same old, same old](https://www.keycdn.com/support/what-is-cache-busting/). If anyone comes up with a solution how subresource integrity and cache-busting / fingerprinting could be achieved by different plugins (as all of them modify Kirby's built-in helper functions `css()` and `js()`), feel free to open a PR! Otherwise, follow the next steps:
 
-### 1. Apache
+### Apache
 If you're using [Apache](http://httpd.apache.org/) as your webserver, add the following lines to your `.htaccess` (right after `RewriteBase`):
 
 ```text
@@ -54,7 +73,7 @@ RewriteCond %{REQUEST_FILENAME} !-f
 RewriteRule ^(.+)\.([0-9]{10})\.(js|css)$ $1.$3 [L]
 ```
 
-### 2. NGINX
+### NGINX
 If you're using [NGINX](https://nginx.org/en/) as your webserver, add the following lines to your virtual host setup:
 
 ```text
@@ -65,9 +84,15 @@ location /assets {
 }
 ```
 
-**Note: Subresource integrity & cache-busting are not applied to external URLs!**
+**Note: SRI hash generation & cache-busting are not applied to external URLs!**
+
+## Be safe - use protection!
+**Always use https:// URLs** when loading subresources from a CDN, otherwise they might get blocked:
+
+> Mixed content occurs when initial HTML is loaded over a secure HTTPS connection, but other resources (such as images, videos, stylesheets, scripts) are loaded over an insecure HTTP connection. This is called mixed content because both HTTP and HTTPS content are being loaded to display the same page, and the initial request was secure over HTTPS. Modern browsers display warnings about this type of content to indicate to the user that this page contains insecure resources.
+> [Google Developers](https://developers.google.com/web/fundamentals/security/prevent-mixed-content/what-is-mixed-content)
 
-## Credits
+## Credits / License
 `kirby-sri` was inspired by Kirby plugins [cachebuster](https://github.com/getkirby-plugins/cachebuster-plugin) (by Kirby team members [Bastian Allgeier](https://github.com/bastianallgeier) and [Lukas Bestle](https://github.com/lukasbestle)) as well as [fingerprint](https://github.com/iksi/kirby-fingerprint) (by [Iksi](https://github.com/iksi)). It is licensed under the [MIT License](LICENSE), but **using Kirby in production** requires you to [buy a license](https://getkirby.com/buy). Are you ready for the [next step](https://getkirby.com/next)?
 
 ## Special Thanks

From 89ec109db34253914482d64861473096e5255a70 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 20:51:46 +0100
Subject: [PATCH 06/11] Updated README

---
 README.md | 38 ++++++++++++++------------------------
 1 file changed, 14 insertions(+), 24 deletions(-)

diff --git a/README.md b/README.md
index 691cfc7..ce8e11a 100644
--- a/README.md
+++ b/README.md
@@ -1,23 +1,13 @@
 # kirby-sri
-This plugin generates base64-encoded cryptographic hashes for your css / js files based on their content and adds them to the `integrity` attribute of their corresponding `<link>` or `<script>` elements.
-
-`kirby-sri` also applies [cache-busting / fingerprinting](#cache-busting--fingerprinting).
-
-![screenshot of the kirby-sri plugin](screenshot.png)
+This plugin generates base64-encoded cryptographic hashes for your css / js files based on their content and adds them to the `integrity` attribute of their corresponding `<link>` or `<script>` elements. It also applies [cache-busting / fingerprinting](#cache-busting--fingerprinting).
 
 **Table of contents**
 - [1. What's SRI?](#whats-sri)
-- [2. Installation](#installation)
-  - [a) Git submodule](#git-submodule)
-  - [b) Clone or download](#clone-or-download)
-- [3. Usage](#usage)
-  - [a) Activation](#activation)
-  - [b) Options](#options)
+- [2. Getting started](#getting-started)
+- [3. Configuration](#configuration)
 - [4. Cachebusting / fingerprinting](#cache-busting--fingerprinting)
-  - [a) Apache](#apache)
-  - [b) NGINX](#nginx)
-- [4. Be safe - use protection!](#be-safe---use-protection)
-- [5. Credits / License](#credits--license)
+- [5. Be safe - use protection!](#be-safe---use-protection)
+- [6. Credits / License](#credits--license)
 
 ## What's SRI?
 > Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.
@@ -25,9 +15,11 @@ This plugin generates base64-encoded cryptographic hashes for your css / js file
 
 Enter `kirby-sri`: Kirby-side generated SRI hashes for [safer CDN usage](https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/). Read more about CDN integration and Kirby in the [docs](https://getkirby.com/docs/cookbook/kirby-loves-cdn)) or over at Kirby's partner [KeyCDN](https://www.keycdn.com/support/kirby-cdn-integration/) to get started.
 
+![screenshot of the kirby-sri plugin](screenshot.png)
+
 **This plugin only provides hash generation.** For usage with CDNs, refer to Kirby's official [`cdn-plugin`](https://github.com/getkirby-plugins/cdn-plugin)!
 
-## Installation
+## Getting started
 Use one of the following methods to install & use `kirby-sri`:
 
 ### Git submodule
@@ -43,24 +35,22 @@ git submodule add https://github.com/S1SYPHOS/kirby-sri.git site/plugins/kirby-s
 1. [Clone](https://github.com/S1SYPHOS/kirby-sri.git) or [download](https://github.com/S1SYPHOS/kirby-sri/archive/master.zip)  this repository.
 2. Unzip / Move the folder to `site/plugins`.
 
-## Usage
-After installing the plugin, you should activate it (if you haven't already, read about [multi-environment setups](https://getkirby.com/docs/developer-guide/configuration/options)) and have a look at its options.
-
-### Activation
+### Activate the plugin
 Activate the plugin with the following line in your `config.php`:
 
 ```text
 c::set('sri-hash', true);
 ```
 
-Kirby's built-in helper functions `css()` and `js()` will now include the `integrity` attribute alongside a matching SRI hash.
+Kirby's built-in helper functions `css()` and `js()` will now include an `integrity` attribute alongside the matching SRI hash. If you want to activate `sri-hash` only on specific domains, read about [multi-environment setups](https://getkirby.com/docs/developer-guide/configuration/options).
 
-### Options
-You may configure `kirby-sri` to suit your needs with the following options:
+## Configuration
+Change `kirby-sri` options to suit your needs:
 
 | Option | Type | Default | Description |
 | --- | --- | --- | --- |
-| `sri-hash.use-credentials` | Boolean | `false` | Sets `crossorigin` attribute to `use-credentials` (default: `anonymous`). |
+| `sri-hash.algorithm` | String | `sha512` | Defines the cryptographic [hash algorithm](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (currently the allowed prefixes are `sha256`, `sha384` and `sha512`). |
+| `sri-hash.use-credentials` | Boolean | `false` | Sets [crossorigin attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_settings_attributes) to `use-credentials` instead of `anonymous`. |
 
 ## Cache-busting / Fingerprinting
 [Same old, same old](https://www.keycdn.com/support/what-is-cache-busting/). If anyone comes up with a solution how subresource integrity and cache-busting / fingerprinting could be achieved by different plugins (as all of them modify Kirby's built-in helper functions `css()` and `js()`), feel free to open a PR! Otherwise, follow the next steps:

From 7335999c732ed74178c2b994e6fd38abaa604b73 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 21:38:40 +0100
Subject: [PATCH 07/11] Add user-defined hash algorithms

- Changing function name to be more specific / unique
- Adding $algorithm as defined in `config.php`
---
 kirby-sri.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kirby-sri.php b/kirby-sri.php
index 092f2d6..953c31b 100644
--- a/kirby-sri.php
+++ b/kirby-sri.php
@@ -9,11 +9,12 @@
 
 if(!c::get('sri-hash')) return;
 
-function checksum($input) {
+public function sri_checksum($input) {
+  $algorithm = c::get('sri-hash.algorithm') ? c::get('sri-hash.algorithm') : 'sha512';
   $hash = hash('sha512', $input, true);
   $hash_base64 = base64_encode($hash);
 
-  return "sha512-$hash_base64";
+  return "$algorithm-$hash_base64";
 }
 
 load([

From 7c5e271a67cd15bfe703fff8c6476d59a71ab1b8 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 21:39:15 +0100
Subject: [PATCH 08/11] Update css.php

---
 core/css.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/css.php b/core/css.php
index 59d8c32..7b87c82 100644
--- a/core/css.php
+++ b/core/css.php
@@ -39,7 +39,7 @@ public function tag($url, $media = null) {
     if (file_exists($url)) {
       // generate sri hash for css files
       $cssInput = (new Asset($url))->content();
-      $cssIntegrity = checksum($cssInput);
+      $cssIntegrity = sri_checksum($cssInput);
 
       // add timestamp for cache-busting
       $modified = filemtime($url);

From 97f0324257d3451ca5573b4d13d377c3cb959999 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 21:39:31 +0100
Subject: [PATCH 09/11] Update js.php

---
 core/js.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/js.php b/core/js.php
index f779c64..83bb346 100644
--- a/core/js.php
+++ b/core/js.php
@@ -39,7 +39,7 @@ public function tag($src, $async = false) {
     if (file_exists($src)) {
       // generate sri hash for css files
       $jsInput = (new Asset($src))->content();
-      $jsIntegrity = checksum($jsInput);
+      $jsIntegrity = sri_checksum($jsInput);
 
       // add timestamp for cache-busting
       $modified = filemtime($src);

From 0c1cad7a7e1adf5322b5985b704f7e284c543512 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 21:49:15 +0100
Subject: [PATCH 10/11] Fixed function 'sri_checksum'

---
 kirby-sri.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kirby-sri.php b/kirby-sri.php
index 953c31b..d99c79a 100644
--- a/kirby-sri.php
+++ b/kirby-sri.php
@@ -9,7 +9,7 @@
 
 if(!c::get('sri-hash')) return;
 
-public function sri_checksum($input) {
+function sri_checksum($input) {
   $algorithm = c::get('sri-hash.algorithm') ? c::get('sri-hash.algorithm') : 'sha512';
   $hash = hash('sha512', $input, true);
   $hash_base64 = base64_encode($hash);

From 02aa2e223e14ae5d5184a2c218db4105f362abf6 Mon Sep 17 00:00:00 2001
From: Martin Folkers <hello@twobrain.io>
Date: Tue, 31 Oct 2017 21:54:21 +0100
Subject: [PATCH 11/11] Released v0.3.0

---
 kirby-sri.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kirby-sri.php b/kirby-sri.php
index d99c79a..f76282c 100644
--- a/kirby-sri.php
+++ b/kirby-sri.php
@@ -11,7 +11,7 @@
 
 function sri_checksum($input) {
   $algorithm = c::get('sri-hash.algorithm') ? c::get('sri-hash.algorithm') : 'sha512';
-  $hash = hash('sha512', $input, true);
+  $hash = hash($algorithm, $input, true);
   $hash_base64 = base64_encode($hash);
 
   return "$algorithm-$hash_base64";