From 2f0625414e5a9a83985d9ce99a56a8c4df45c7e6 Mon Sep 17 00:00:00 2001
From: good-karma <feruz@esteem.app>
Date: Tue, 10 Jun 2025 09:49:09 +0000
Subject: [PATCH 1/5] Update 2 files

- /src/server/server-html.jsx
- /docker-compose.prod.yml
---
 docker-compose.prod.yml    |  2 +-
 src/server/server-html.jsx | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index d224f44a2..ee6f31ccd 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -30,7 +30,7 @@ services:
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
             SDC_ALT_API_ENDPOINTS: "https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com"
-            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://images.hive.blog https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
+            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://images.hive.blog https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
             WALLET_URL: https://wallet.hive.blog
diff --git a/src/server/server-html.jsx b/src/server/server-html.jsx
index 01517cbdc..8de21609d 100644
--- a/src/server/server-html.jsx
+++ b/src/server/server-html.jsx
@@ -100,6 +100,22 @@ export default function ServerHTML({
                 {assets.style.map((href) => (
                     <link href={href} key={href} rel="stylesheet" type="text/css" />
                 ))}
+                <script
+                    defer
+                    data-domain="hive.blog"
+                    src="https://pl.ecency.com/js/script.hash.outbound-links.js"
+                />
+                <script
+                    // eslint-disable-next-line react/no-danger
+                    dangerouslySetInnerHTML={{
+                        __html: `
+                            window.plausible = window.plausible || function() {
+                                (window.plausible.q = window.plausible.q || []).push(arguments)
+                            }
+                        `,
+                    }}
+                />
+
                 {shouldSeeCookieConsent ? (
                     <script
                         id="Cookiebot"
-- 
GitLab


From 07a80636f0e083ab660961c47fe7cf061abc6081 Mon Sep 17 00:00:00 2001
From: good-karma <feruz@esteem.app>
Date: Tue, 10 Jun 2025 09:51:01 +0000
Subject: [PATCH 2/5] Update 3 files

- /docker-compose.dev.yml
- /docker-compose.localbuild.yml
- /docker-compose.staging.yml
---
 docker-compose.dev.yml        | 2 +-
 docker-compose.localbuild.yml | 2 +-
 docker-compose.staging.yml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index a3b76d5a2..bb5c05af7 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -19,7 +19,7 @@ services:
 
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-            SDC_HELMET_CONNECTSRC: "'self' http://hiveblog.local https://api.hive.blog https://images.hive.blog https://www.reddit.com *.ibytedtos.com"
+            SDC_HELMET_CONNECTSRC: "'self' http://hiveblog.local https://api.hive.blog https://images.hive.blog https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
         volumes:
diff --git a/docker-compose.localbuild.yml b/docker-compose.localbuild.yml
index e3f8c9809..98fd63f98 100644
--- a/docker-compose.localbuild.yml
+++ b/docker-compose.localbuild.yml
@@ -11,7 +11,7 @@ services:
             SDC_SITE_DOMAIN: hive.blog
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://api.hive.blog https://anyx.io api.blocktrades.us https://images.hive.blog https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
+            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://api.hive.blog https://anyx.io api.blocktrades.us https://images.hive.blog https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
             WALLET_URL: https://wallet.hive.blog
diff --git a/docker-compose.staging.yml b/docker-compose.staging.yml
index e73f0c6d6..3d0a8424e 100644
--- a/docker-compose.staging.yml
+++ b/docker-compose.staging.yml
@@ -13,7 +13,7 @@ services:
          SDC_SITE_DOMAIN: staging-blog.hive.io
          SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
          SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-         SDC_HELMET_CONNECTSRC: "'self' https://api.hive.blog https://staging.hive.blog https://images.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
+         SDC_HELMET_CONNECTSRC: "'self' https://api.hive.blog https://staging.hive.blog https://images.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
          SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
          SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
          WALLET_URL: https://wallet.hive.blog
-- 
GitLab


From cdadb77cbc1f2f7d6555704fb6736d8cc01c72a9 Mon Sep 17 00:00:00 2001
From: Quoc Huy Nguyen Dinh <huy.nguyen@sbs.com.au>
Date: Thu, 12 Jun 2025 14:55:13 +1000
Subject: [PATCH 3/5] Fix crashes when body contains <iframe>

---
 src/shared/HtmlReady.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/HtmlReady.js b/src/shared/HtmlReady.js
index 60be36be5..d603c0b91 100644
--- a/src/shared/HtmlReady.js
+++ b/src/shared/HtmlReady.js
@@ -231,7 +231,10 @@ function iframe(state, child) {
         aspectRatioPercent = (height.value / width.value) * 100;
     }
 
-    child.parentNode.replaceChild(DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`), child);
+    child.parentNode.replaceChild(
+        DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`, 'text/xml').documentElement,
+        child
+    );
     const styleAttr = document.createAttribute('style');
     styleAttr.value = `position: relative; width: 100%; height: 0; padding-bottom: ${aspectRatioPercent}%;`;
     child.attributes.setNamedItem(styleAttr);
-- 
GitLab


From 90eb988c0988f53125256eac5e0c6ef25fff5ba5 Mon Sep 17 00:00:00 2001
From: Gandalf <gandalf@storm.pl>
Date: Sat, 19 Jul 2025 22:41:12 +0200
Subject: [PATCH 4/5] Revert changes from recent commits in develop to clean
 history and keep only iframe crash fix

---
 docker-compose.dev.yml        |  2 +-
 docker-compose.localbuild.yml |  2 +-
 docker-compose.prod.yml       |  2 +-
 docker-compose.staging.yml    |  2 +-
 src/server/server-html.jsx    | 16 ----------------
 src/shared/HtmlReady.js       |  5 +----
 6 files changed, 5 insertions(+), 24 deletions(-)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index bb5c05af7..a3b76d5a2 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -19,7 +19,7 @@ services:
 
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-            SDC_HELMET_CONNECTSRC: "'self' http://hiveblog.local https://api.hive.blog https://images.hive.blog https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
+            SDC_HELMET_CONNECTSRC: "'self' http://hiveblog.local https://api.hive.blog https://images.hive.blog https://www.reddit.com *.ibytedtos.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
         volumes:
diff --git a/docker-compose.localbuild.yml b/docker-compose.localbuild.yml
index 98fd63f98..e3f8c9809 100644
--- a/docker-compose.localbuild.yml
+++ b/docker-compose.localbuild.yml
@@ -11,7 +11,7 @@ services:
             SDC_SITE_DOMAIN: hive.blog
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://api.hive.blog https://anyx.io api.blocktrades.us https://images.hive.blog https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
+            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://api.hive.blog https://anyx.io api.blocktrades.us https://images.hive.blog https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
             WALLET_URL: https://wallet.hive.blog
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ee6f31ccd..d224f44a2 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -30,7 +30,7 @@ services:
             SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
             SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
             SDC_ALT_API_ENDPOINTS: "https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com"
-            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://images.hive.blog https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
+            SDC_HELMET_CONNECTSRC: "'self' hive.blog https://hive.blog https://images.hive.blog https://api.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
             SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
             SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
             WALLET_URL: https://wallet.hive.blog
diff --git a/docker-compose.staging.yml b/docker-compose.staging.yml
index 3d0a8424e..e73f0c6d6 100644
--- a/docker-compose.staging.yml
+++ b/docker-compose.staging.yml
@@ -13,7 +13,7 @@ services:
          SDC_SITE_DOMAIN: staging-blog.hive.io
          SDC_IMAGE_PROXY_PREFIX: https://images.hive.blog/
          SDC_UPLOAD_IMAGE_URL: https://images.hive.blog
-         SDC_HELMET_CONNECTSRC: "'self' https://api.hive.blog https://staging.hive.blog https://images.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com https://pl.ecency.com"
+         SDC_HELMET_CONNECTSRC: "'self' https://api.hive.blog https://staging.hive.blog https://images.hive.blog https://anyx.io https://api.openhive.network https://api.hivekings.com https://hivebuzz.me https://peakd.com https://www.reddit.com *.ibytedtos.com"
          SDC_HELMET_STYLESRC: "'self' 'unsafe-inline' fonts.googleapis.com platform.twitter.com www.reddit.com cdn.embedly.com *.tiktokcdn.com"
          SDC_HELMET_FONTSRC: "data: fonts.gstatic.com cdn.embedly.com"
          WALLET_URL: https://wallet.hive.blog
diff --git a/src/server/server-html.jsx b/src/server/server-html.jsx
index 8de21609d..01517cbdc 100644
--- a/src/server/server-html.jsx
+++ b/src/server/server-html.jsx
@@ -100,22 +100,6 @@ export default function ServerHTML({
                 {assets.style.map((href) => (
                     <link href={href} key={href} rel="stylesheet" type="text/css" />
                 ))}
-                <script
-                    defer
-                    data-domain="hive.blog"
-                    src="https://pl.ecency.com/js/script.hash.outbound-links.js"
-                />
-                <script
-                    // eslint-disable-next-line react/no-danger
-                    dangerouslySetInnerHTML={{
-                        __html: `
-                            window.plausible = window.plausible || function() {
-                                (window.plausible.q = window.plausible.q || []).push(arguments)
-                            }
-                        `,
-                    }}
-                />
-
                 {shouldSeeCookieConsent ? (
                     <script
                         id="Cookiebot"
diff --git a/src/shared/HtmlReady.js b/src/shared/HtmlReady.js
index d603c0b91..60be36be5 100644
--- a/src/shared/HtmlReady.js
+++ b/src/shared/HtmlReady.js
@@ -231,10 +231,7 @@ function iframe(state, child) {
         aspectRatioPercent = (height.value / width.value) * 100;
     }
 
-    child.parentNode.replaceChild(
-        DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`, 'text/xml').documentElement,
-        child
-    );
+    child.parentNode.replaceChild(DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`), child);
     const styleAttr = document.createAttribute('style');
     styleAttr.value = `position: relative; width: 100%; height: 0; padding-bottom: ${aspectRatioPercent}%;`;
     child.attributes.setNamedItem(styleAttr);
-- 
GitLab


From de56adaaeca30e5ba8648a25867ec4b54128959f Mon Sep 17 00:00:00 2001
From: Quoc Huy Nguyen Dinh <huy.nguyen@sbs.com.au>
Date: Thu, 12 Jun 2025 14:55:13 +1000
Subject: [PATCH 5/5] Fix crashes when body contains <iframe>

---
 src/shared/HtmlReady.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/HtmlReady.js b/src/shared/HtmlReady.js
index 60be36be5..d603c0b91 100644
--- a/src/shared/HtmlReady.js
+++ b/src/shared/HtmlReady.js
@@ -231,7 +231,10 @@ function iframe(state, child) {
         aspectRatioPercent = (height.value / width.value) * 100;
     }
 
-    child.parentNode.replaceChild(DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`), child);
+    child.parentNode.replaceChild(
+        DOMParser.parseFromString(`<div class="iframeWrapper">${html}</div>`, 'text/xml').documentElement,
+        child
+    );
     const styleAttr = document.createAttribute('style');
     styleAttr.value = `position: relative; width: 100%; height: 0; padding-bottom: ${aspectRatioPercent}%;`;
     child.attributes.setNamedItem(styleAttr);
-- 
GitLab