Use the SRI hashes for the live site's assets. (#25282)

diff --git a/_includes/header.html b/_includes/header.html
index f2f1deff863d9e60d74c895e4bbd9418dd6bf591..85d3753e1cba66eb8722df52e72c4f066bfe3612 100644 (file)
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -14,7 +14,7 @@
 
 <!-- Bootstrap core CSS -->
 {% if site.github %}
-<link href="{{ site.baseurl }}/dist/css/bootstrap.min.css" rel="stylesheet">
+<link href="{{ site.baseurl }}/dist/css/bootstrap.min.css" rel="stylesheet" integrity="{{ site.cdn.css_hash }}" crossorigin="anonymous">
 {% else %}
 <link href="{{ site.baseurl }}/dist/css/bootstrap.css" rel="stylesheet">
 {% endif %}

diff --git a/_includes/scripts.html b/_includes/scripts.html
index ee598dcc4d5ca8bfed29c217168892275d156082..7c262149f28c5a0e3e5917e9f9a2a83b542f663e 100644 (file)
--- a/_includes/scripts.html
+++ b/_includes/scripts.html
@@ -1,10 +1,10 @@
 <script src="{{ site.cdn.jquery }}" integrity="{{ site.cdn.jquery_hash }}" crossorigin="anonymous"></script>
 <script>window.jQuery || document.write('<script src="{{ site.baseurl }}/assets/js/vendor/jquery-slim.min.js"><\/script>')</script>
 
-<script src="{{ site.baseurl }}/assets/js/vendor/popper.min.js"></script>
+<script src="{{ site.baseurl }}/assets/js/vendor/popper.min.js"{% if site.github %} integrity="{{ site.cdn.popper_hash }}" crossorigin="anonymous"{% endif %}></script>
 
 {%- if site.github -%}
-  <script src="{{ site.baseurl }}/dist/js/bootstrap.min.js"></script>
+  <script src="{{ site.baseurl }}/dist/js/bootstrap.min.js" integrity="{{ site.cdn.js_hash }}" crossorigin="anonymous"></script>
 {%- else -%}
   <script src="{{ site.baseurl }}/dist/js/bootstrap.js"></script>
 {%- endif -%}