diff --git a/app/lib/server/startup/settings.js b/app/lib/server/startup/settings.js index e358690dc653..c393cc696413 100644 --- a/app/lib/server/startup/settings.js +++ b/app/lib/server/startup/settings.js @@ -956,6 +956,37 @@ settings.addGroup('General', function() { public: true, multiline: true, }); + this.add('Default_Referrer_Policy', 'same-origin', { + type: 'select', + values: [ + { + key: 'no-referrer', + i18nLabel: 'No_Referrer', + }, { + key: 'no-referrer-when-downgrade', + i18nLabel: 'No_Referrer_When_Downgrade', + }, { + key: 'origin', + i18nLabel: 'Origin', + }, { + key: 'origin-when-cross-origin', + i18nLabel: 'Origin_When_Cross_Origin', + }, { + key: 'same-origin', + i18nLabel: 'Same_Origin', + }, { + key: 'strict-origin', + i18nLabel: 'Strict_Origin', + }, { + key: 'strict-origin-when-cross-origin', + i18nLabel: 'Strict_Origin_When_Cross_Origin', + }, { + key: 'unsafe-url', + i18nLabel: 'Unsafe_Url', + }, + ], + public: true, + }); this.section('UTF8', function() { this.add('UTF8_Names_Validation', '[0-9a-zA-Z-_.]+', { type: 'string', diff --git a/app/ui-master/server/inject.js b/app/ui-master/server/inject.js index 10cb94e51464..17e5d9f1f08a 100644 --- a/app/ui-master/server/inject.js +++ b/app/ui-master/server/inject.js @@ -34,7 +34,13 @@ Meteor.startup(() => { Inject.rawModHtml('headInjections', applyHeadInjections(injections)); }); - injectIntoHead('noreferrer', ''); + settings.get('Default_Referrer_Policy', (key, value) => { + if (!value) { + return injectIntoHead('noreferrer', ''); + } + + injectIntoHead('noreferrer', ``); + }); if (process.env.DISABLE_ANIMATION) { injectIntoHead('disable-animation', ` diff --git a/packages/rocketchat-i18n/i18n/en.i18n.json b/packages/rocketchat-i18n/i18n/en.i18n.json index 86432071198e..31e050fd5141 100644 --- a/packages/rocketchat-i18n/i18n/en.i18n.json +++ b/packages/rocketchat-i18n/i18n/en.i18n.json @@ -3397,6 +3397,16 @@ "Return_to_previous_page": "Return to previous page", "Return_to_the_queue": "Return back to the Queue", "Robot_Instructions_File_Content": "Robots.txt File Contents", + "Default_Referrer_Policy": "Default Referrer Policy", + "Default_Referrer_Policy_Description": "This controls the 'referrer' header that's sent when requesting embedded media from other servers. For more information, refer to this link from MDN. Remember, a full page refresh is required for this to take effect", + "No_Referrer": "No Referrer", + "No_Referrer_When_Downgrade": "No referrer when downgrade", + "Origin": "Origin", + "Origin_When_Cross_Origin": "Origin when cross origin", + "Same_Origin": "Same origin", + "Strict_Origin": "Strict origin", + "Strict_Origin_When_Cross_Origin": "Strict origin when cross origin", + "Unsafe_Url": "Unsafe URL", "Rocket_Chat_Alert": "Rocket.Chat Alert", "Role": "Role", "Role_Editing": "Role Editing",