From: Chris Barry <chris@barry.im>
Date: Tue, 29 Sep 2015 02:12:57 +0000 (-0400)
Subject: Adding subresource hashes to CDN links.
X-Git-Tag: v3.3.6~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9aeec56745fde5db4ce0c1992bc1c5a9c70ea9c8;p=thirdparty%2Fbootstrap.git

Adding subresource hashes to CDN links.

In Firefox 43 and Chrome 45 there will be support for Subresource
Iintegrity (SRI). More information here:
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Closes #17729 by merging a tweaked version of it.
---

diff --git a/_config.yml b/_config.yml
index 1ee9422848..39abfb7fdc 100644
--- a/_config.yml
+++ b/_config.yml
@@ -27,6 +27,10 @@ blog:             http://blog.getbootstrap.com
 expo:             http://expo.getbootstrap.com
 
 cdn:
+  # See https://www.srihash.org for info on how to generate the hashes
   css:            https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css
+  css_hash:       "sha512-dTfge/zgoMYpP7QbHy4gWMEGsbsdZeCXz7irItjcC3sPUFtf0kuFbDz/ixG7ArTxmDjLXDmezHubeNikyKGVyQ=="
   css_theme:      https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css
+  css_theme_hash: "sha384-aUGj/X2zp5rLCbBxumKTCw2Z50WgIr1vs/PFN4praOTvYXWlVyh2UtNUU0KAUhAX"
   js:             https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js
+  js_hash:        "sha512-K1qjQ+NcF2TYO/eI3M6v8EiNYZfA95pQumfvcVrTHtwQVDG+aHRqLi/ETn2uB+1JqwYqVG3LIvdm9lj6imS/pQ=="
diff --git a/docs/_includes/getting-started/download.html b/docs/_includes/getting-started/download.html
index bc25122bde..1fb3aab615 100644
--- a/docs/_includes/getting-started/download.html
+++ b/docs/_includes/getting-started/download.html
@@ -31,13 +31,13 @@
   <p>The folks over at <a href="https://www.maxcdn.com/">MaxCDN</a> graciously provide CDN support for Bootstrap's CSS and JavaScript. Just use these <a href="https://www.bootstrapcdn.com/">Bootstrap CDN</a> links.</p>
 {% highlight html %}
 <!-- Latest compiled and minified CSS -->
-<link rel="stylesheet" href="{{ site.cdn.css }}">
+<link rel="stylesheet" href="{{ site.cdn.css }}" integrity="{{ site.cdn.css_hash }}" crossorigin="anonymous">
 
 <!-- Optional theme -->
-<link rel="stylesheet" href="{{ site.cdn.css_theme }}">
+<link rel="stylesheet" href="{{ site.cdn.css_theme }}" integrity="{{ site.cdn.css_theme_hash }}" crossorigin="anonymous">
 
 <!-- Latest compiled and minified JavaScript -->
-<script src="{{ site.cdn.js }}"></script>
+<script src="{{ site.cdn.js }}" integrity="{{ site.cdn.js_hash }}" crossorigin="anonymous"></script>
 {% endhighlight %}
 
   <h2 id="download-bower">Install with Bower</h2>