From 95fc89f95ddee7b91870afab197f07f5366d3b1e Mon Sep 17 00:00:00 2001
From: Dylan Staley <88163+dstaley@users.noreply.github.com>
Date: Fri, 7 Feb 2020 12:19:39 -0800
Subject: [PATCH 1/2] enable csp

---
 _headers                   | 1 +
 theme/static/css/kinto.css | 7 +++++++
 theme/templates/icons.html | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/_headers b/_headers
index e7b5a01..e72b7b5 100644
--- a/_headers
+++ b/_headers
@@ -2,3 +2,4 @@
   X-Frame-Options: DENY
   X-XSS-Protection: 1; mode=block
   X-Content-Type-Options: nosniff
+  Content-Security-Policy: default-src 'self'
\ No newline at end of file
diff --git a/theme/static/css/kinto.css b/theme/static/css/kinto.css
index 2e8293b..d07658d 100644
--- a/theme/static/css/kinto.css
+++ b/theme/static/css/kinto.css
@@ -664,3 +664,10 @@ article > ol {
   opacity: 0.8;
   margin-top: 2em;
 }
+
+.icon-sprite {
+  position: absolute;
+  width: 0;
+  height: 0;
+  overflow: hidden;
+}
\ No newline at end of file
diff --git a/theme/templates/icons.html b/theme/templates/icons.html
index 03c4db4..c3a6290 100644
--- a/theme/templates/icons.html
+++ b/theme/templates/icons.html
@@ -1,4 +1,4 @@
-<svg aria-hidden="true" style="position: absolute; width: 0; height: 0; overflow: hidden;" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<svg aria-hidden="true" class="icon-sprite" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
     <defs>
         <symbol id="icon-database" viewBox="0 0 448 512"><path d="M448 73.143v45.714C448 159.143 347.667 192 224 192S0 159.143 0 118.857V73.143C0 32.857 100.333 0 224 0s224 32.857 224 73.143zM448 176v102.857C448 319.143 347.667 352 224 352S0 319.143 0 278.857V176c48.125 33.143 136.208 48.572 224 48.572S399.874 209.143 448 176zm0 160v102.857C448 479.143 347.667 512 224 512S0 479.143 0 438.857V336c48.125 33.143 136.208 48.572 224 48.572S399.874 369.143 448 336z"/></symbol>
         <symbol id="icon-edit" viewBox="0 0 576 512"><path d="M402.6 83.2l90.2 90.2c3.8 3.8 3.8 10 0 13.8L274.4 405.6l-92.8 10.3c-12.4 1.4-22.9-9.1-21.5-21.5l10.3-92.8L388.8 83.2c3.8-3.8 10-3.8 13.8 0zm162-22.9l-48.8-48.8c-15.2-15.2-39.9-15.2-55.2 0l-35.4 35.4c-3.8 3.8-3.8 10 0 13.8l90.2 90.2c3.8 3.8 10 3.8 13.8 0l35.4-35.4c15.2-15.3 15.2-40 0-55.2zM384 346.2V448H64V128h229.8c3.2 0 6.2-1.3 8.5-3.5l40-40c7.6-7.6 2.2-20.5-8.5-20.5H48C21.5 64 0 85.5 0 112v352c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48V306.2c0-10.7-12.9-16-20.5-8.5l-40 40c-2.2 2.3-3.5 5.3-3.5 8.5z"/></symbol>

From 603f82e11a9c427cd45a4ccf5d9d6c399f91b5f4 Mon Sep 17 00:00:00 2001
From: Dylan Staley <88163+dstaley@users.noreply.github.com>
Date: Fri, 7 Feb 2020 12:19:56 -0800
Subject: [PATCH 2/2] lazy load admin image

---
 content/pages/about.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/pages/about.html b/content/pages/about.html
index d81f76a..255688b 100644
--- a/content/pages/about.html
+++ b/content/pages/about.html
@@ -145,7 +145,7 @@ <h2 class="k-major k-section-header">A growing ecosystem of tools and SDKs</h2>
               <a href="https://kinto.github.io/kinto-admin/">
                 <picture>
                   <source type="image/webp" srcset="images/admin_400.webp 1x, images/admin_800.webp 2x, images/admin_1200.webp 3x" />
-                  <img src="images/admin_400.jpg" srcset="images/admin_400.jpg 1x, images/admin_800.jpg 2x, images/admin_1200.jpg 3x" alt="Screenshot of Kinto web admin" />
+                  <img loading="lazy" src="images/admin_400.jpg" srcset="images/admin_400.jpg 1x, images/admin_800.jpg 2x, images/admin_1200.jpg 3x" alt="Screenshot of Kinto web admin" />
                 </picture>
               </a>
               <p>A full featured <a href="https://kinto.github.io/kinto-admin/">Web Admin</a> makes managing your data a breeze.</p>