Use the render() function rather than Vue templating, and use the
Vue runtime-only build [1]. This is so that the eval() function, which
the CSP blocks, in the Vue full build is not used. Conversion of
previous template logic to using createElement() is done accordingly.
Drop generated runtime JS files that are not needed anymore, which were
added in a9fb7591b4a77a9c4baca6f3e8fbb0405a2f71fd.
Also improve the general structure of the code, by adding a streamDisplay
data member, which holds display information for the downloadable images
in each section. This structure is populated whenever stream data is
refreshed, by loadStreamDisplay(). The render function then reads
from streamDisplay.
Finally, some minor tweaks to spacing and text are made on the page,
however the page renders largely the same as before.
Verified locally running the Flask development server.
This should be compatible with the CSP:
- no inline style when rendering the download page
- coreos-download.js is included as a separate file (no inline scripts)
- the Vue runtime-only build is used, rather than the full
Rendered HTML and a screenshot of the download page from this PR: https://rfairley.fedorapeople.org/websites-review/coreos-download-pr-44-1.zip
Use the render() function rather than Vue templating, and use the
Vue runtime-only build [1]. This is so that the eval() function, which
the CSP blocks, in the Vue full build is not used. Conversion of
previous template logic to using
createElement()is done accordingly.Drop generated runtime JS files that are not needed anymore, which were
added in a9fb7591b4a77a9c4baca6f3e8fbb0405a2f71fd.
Also improve the general structure of the code, by adding a
streamDisplaydata member, which holds display information for the downloadable images
in each section. This structure is populated whenever stream data is
refreshed, by
loadStreamDisplay(). Therenderfunction then readsfrom
streamDisplay.Finally, some minor tweaks to spacing and text are made on the page,
however the page renders largely the same as before.
[1] https://vuejs.org/v2/guide/installation.html#Runtime-Compiler-vs-Runtime-only
Signed-off-by: Robert Fairley rfairley@redhat.com
Verified locally running the Flask development server.
This should be compatible with the CSP:
- no inline style when rendering the download page
- coreos-download.js is included as a separate file (no inline scripts)
- the Vue runtime-only build is used, rather than the full
Rendered HTML and a screenshot of the download page from this PR: https://rfairley.fedorapeople.org/websites-review/coreos-download-pr-44-1.zip