From 5ff5ad113b1cad289f537b08042a0f57f32eb7cb Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Wed, 17 Jan 2024 19:37:47 +0000
Subject: [PATCH] Load potentially external images without referrer

---
 website/common/templates/common/listing-item.html | 2 +-
 website/common/templates/wagtail_base.html        | 2 +-
 website/contrib/unsplash/widgets.py               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/common/templates/common/listing-item.html b/website/common/templates/common/listing-item.html
index 92fedea..88e5111 100644
--- a/website/common/templates/common/listing-item.html
+++ b/website/common/templates/common/listing-item.html
@@ -6,7 +6,7 @@
     <figure class="media-left column is-3 image-column">
       {% if page.list_image_url %}
         <a href="{% pageurl page %}" class="image" title="{{ page.title }}">
-          <img src="{{ page.list_image_url }}" alt="{{ page.hero_image_alt }}" loading="lazy" decoding="async" />
+          <img src="{{ page.list_image_url }}" alt="{{ page.hero_image_alt }}" loading="lazy" decoding="async" referrerpolicy="no-referrer" />
         </a>
       {% endif %}
     </figure>
diff --git a/website/common/templates/wagtail_base.html b/website/common/templates/wagtail_base.html
index 4d7bb69..f34b5b0 100644
--- a/website/common/templates/wagtail_base.html
+++ b/website/common/templates/wagtail_base.html
@@ -15,7 +15,7 @@
     <picture>
       {% for width, image_url in page.hero_image_urls.items reversed %}<source srcset="{{ image_url }}" media="(max-width: {{ width }}px)" />{% endfor %}
 
-      <img class="hero" src="{{ page.hero_image_url }}" decoding="async" alt="{{ page.hero_image_alt }}" />
+      <img class="hero" src="{{ page.hero_image_url }}" referrerpolicy="no-referrer" decoding="async" alt="{{ page.hero_image_alt }}" />
     </picture>
   {% endif %}
 
diff --git a/website/contrib/unsplash/widgets.py b/website/contrib/unsplash/widgets.py
index 8e5f426..a083f1a 100644
--- a/website/contrib/unsplash/widgets.py
+++ b/website/contrib/unsplash/widgets.py
@@ -14,6 +14,6 @@ class UnsplashPhotoChooser(AdminChooser):
 
     def get_title(self, instance: UnsplashPhoto) -> str:
         return format_html(
-            "<img src='{}' width=165 loading='lazy' decoding='async'>",
+            "<img src='{}' width=165 loading='lazy' decoding='async' referrerpolicy='no-referrer'>",
             instance.get_thumbnail_url(),
         )