plugins/viewhtml: add opt-in query param to load remote resources

Loading remote resources by default has privacy implications.

1 files changed, 12 insertions, 0 deletions

diff --git a/plugins/viewhtml/plugin.go b/plugins/viewhtml/plugin.go
index b34372f..1007d4a 100644
--- a/plugins/viewhtml/plugin.go
+++ b/plugins/viewhtml/plugin.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"git.sr.ht/~emersion/koushin"
+	koushinbase "git.sr.ht/~emersion/koushin/plugins/base"
 	"github.com/labstack/echo/v4"
 )
 
@@ -20,6 +21,17 @@ var (
 func init() {
 	p := koushin.GoPlugin{Name: "viewhtml"}
 
+	p.Inject("message.html", func(ctx *koushin.Context, _data koushin.RenderData) error {
+		data := _data.(*koushinbase.MessageRenderData)
+		data.Extra["RemoteResourcesAllowed"] = ctx.QueryParam("allow-remote-resources") == "1"
+		hasRemoteResources := false
+		if v := ctx.Get("viewhtml.hasRemoteResources"); v != nil {
+			hasRemoteResources = v.(bool)
+		}
+		data.Extra["HasRemoteResources"] = hasRemoteResources
+		return nil
+	})
+
 	p.GET("/proxy", func(ctx *koushin.Context) error {
 		if !proxyEnabled {
 			return echo.NewHTTPError(http.StatusForbidden, "proxy disabled")