[fix] oscar theme, remove inline style attributes (CSP compliants)

[return42]

Inline styles are blocked by default with Content Security Policy (CSP). Move the rest of inline styles to CSS and correct the HTML template of the oscar preference page. Fix of the error messages from Chrome based browsers::

.. Refused to apply inline style because ..

see comment: #1949 (comment)

Merged into the searx-next branch / preview: https://darmarit.org/searx/preferences

[return42]

@asciimoo can you please merge this PR first before adding any more patches to the oscar theme. I am tired to wake up every morning and to have solve conflicts in the min.js files first / thanks!

[return42]

BTW 2c6531b breaks the pep8 test of all the PRs awaiting in the pipe. See 2c6531b#diff-65ed3496c99aad64ac6a6e71504e0101R40

OT / it is not only this PR, and I am really sorry to say:

I'm getting more and more frustrated. I invested months of work to improve searx substantially (see searx-next merged PRs). But my PRs are ignored, which entails considerable maintenance costs: Instead of reviewing PRs, changes are shot in, which additionally increase the organizational overhead. Something is going wrong if we are three developers here and generate an organizational effort that is otherwise only known from sluggish, large companies.

[HLFH]

Hi @asciimoo,

I'm getting more and more frustrated. I invested months of work to improve searx substantially (see searx-next merged PRs). But my PRs are ignored, which entails considerable maintenance costs: Instead of reviewing PRs, changes are shot in, which additionally increase the organizational overhead. Something is going wrong if we are three developers here and generate an organizational effort that is otherwise only known from sluggish, large companies.

Can this be fixed @asciimoo?

Thanks!

[return42]

WTH I am saying!?! .. commit 4ca0d8c is next one, directly shot in without a review process.

I feel like i am trapped in the groundhog-day time loop .. next manual merge cc721b5 of a conflict caused by 4ca0d8c.

@HLFH thanks for your support .. but I guess all we are writing here goes directly into @asciimoo 's spam folder .. also tried personal mails, seems also going into spam .. sometimes (really rare) I get a answer (with little informative value, not really a knowledge exchange) .. mostly I am ignored.

[return42]

OK, another conflict and this PR is ignored .. I gave up.

[SuperSandro2000]

If we wouldn't commit the minified files this PR wouldn't conflict as often but it also could have been merged a while ago.

[return42]

Yes minified and binaries are causing problems in collaboration .. as far as I know @asciimoo do not want to have a build process / sorry, can't remember where I have read this. May be he as changed his opinion about .. @asciimoo ?

Ah, forgot, we will not get an answer ..

[asciimoo]

@asciimoo can you please merge this PR first before adding any more patches to the oscar theme. I am tired to wake up every morning and to have solve conflicts in the min.js files first / thanks!

My main priority was to resolve issues required to release 1.0.0 , sorry if it caused problems to you. Probably the conflicts are mostly in the minified resources what can be easily resolved.

I'm getting more and more frustrated.

Im so sad reading this. Apologies for this. If it's my fault, please help me with suggesting solutions to avoid such situations.

I invested months of work to improve searx substantially (see searx-next merged PRs). But my PRs are ignored

They are not ignored. I'm trying to do everything in my limited time and sometimes it's really hard to prioritize and allocate enough time to digest multiple thousand lines long PRs and 30-40-50 mails daily basis just about searx while I also have other projects/jobs.

also tried personal mails, seems also going into spam

I think It isn't my fault that gmail classified your emails as spam. Probably It's a mail server misconfiguration issue.

@asciimoo do not want to have a build process

I don't think I've ever said something like this, but whether it happened or not, now I'd like to explicitly state that I'm not against any kind of improvement that can help the development or the job of the contributors/maintainers.
I know that there are so many unresolved issues around the development, let's focus on finding solutions for these.

[return42]

@asciimoo thanks for taking this into account. I will answer the more general aspects in #2025

My main priority was to resolve issues required to release 1.0.0

Can we please add CSP to that list. I have seen that others add exceptions for the style to the HTTP headers, but I think it is better to isolate style into CSS files.

I think It isn't my fault that gmail classified your emails as spam. Probably It's a mail server misconfiguration issue.

Its first time I hear about such problems with my mail server and I do not know how to trainee g-mails's spam filter. I know from many filters, that they wont filter out mails from senders which are in the contatcs. May it helps if you add my e-mail address to your contacts.

I don't think I've ever said something like this ..I know that there are so many unresolved issues around the development, let's focus on finding solutions for these.

Ah, OK .. that is fine for me, lets add a build process to eliminate conflicts in build products. I started issue #2034 .. if you have some ideas, your remarks are welcome / or better say: your remarks are needed :)

[dalf]

Except the conflicting files, LGTM.

[asciimoo]

<style> tags in the HTML don't compromise the CSP?

[dalf]

<style> tags in the HTML don't compromise the CSP?

@asciimoo , are you referencing this pattern

    <noscript>
        <style type="text/css">
...
        </style>
    </noscript>

?

True, no javascript doesn't mean the browser doesn't support CSP (typically with Firefox with the uMatrix extension).

• One solution is to add a file ( .less then produce a .css).
• Another solution is to add a js CSS class like in the simple theme: https://github.com/asciimoo/searx/blob/6fbba63c83b18a652e571ce5a803773cd72e5b6a/searx/static/themes/simple/js/searx.head.js#L39
• A third solution: add a nonce-<base64-value> value in the CSP header, which is related to HTTP headers #715

For now, this PR fixes the more common use case: a browser with Javascript and CSP support.

[asciimoo]

@asciimoo , are you referencing this pattern

Yup

For now, this PR fixes the more common use case: a browser with Javascript and CSP support.

Okay, I have no problem with merging the current state, but keep in mind these <style> tags too.

[SuperSandro2000]

You can find a very good documentation here. The paragraph Unsafe inline styles is probably the most intersting.

[return42]

I just wanted to remark, that I think; setting style-src 'unsafe-inline' is not really the best solution.

[SuperSandro2000]

I did not want to suggest that. It is just Mozillas doc on the CSP style-src and what falls under 'unsafe-inline'.

[asciimoo]

@return42 could you please rebase it for the last time to be able to merge it?

[return42]

could you please rebase it for the last time to be able to merge it?

@asciimoo yes, done / see f14a7ad

[asciimoo]

Great, thanks!
Could you please rebase in the future instead of merging back the master into the feature branch? It keeps the git tree clean. Currently our master branch looks like a busy train station:

[SuperSandro2000]

The image looks like art. 😂

[return42]

Could you please rebase in the future instead of merging back the master into the feature branch?

I see, sorry .. ATM this is a result of the way I merge PRs with searx-next branch.

I do not have a clue how I could rebase a public branch (PR) which is already merged into another public branch (searx-next)

@SuperSandro2000, @dalf and me discussed this subject beginning near by #1985 (comment)

Does anyone have a clue, how I can organize my searx-next branch and the branches from PRs without getting in conflict with the golden rule; “No one shall rebase a shared branch”? I guess I'm not the only one asking this question.

[asciimoo]

What is the purpose of your searx-next branch? Cherry-picking is also an option which can work here I think.

[return42]

What is the purpose of your searx-next branch?

When I had a few PRs in the loop, I started that branch. It purpose is to merge PRs aimed to merge at asciimoo/master (in general, not restricted to PRs of mine).

This branch has it's reference instance at https://darmarit.org/searx/ and the documentation of the brand is available at https://return42.github.io/searx/

Cherry-picking is also an option which can work here I think.

This is was others also suggested, but sooner or later it will end in a mess, so I prefer to track branches (pull requests).

[asciimoo]

s branch has it's reference instance at https://darmarit.org/searx/

I see, thanks for the clarification.

but sooner or later it will end in a mess

Maintaining two different forks always has its challenges, but the current solution also causes mess in our side. Please try cherry-picking and lets continue the brainstorming if it's too uncomfortable.

[return42]

but the current solution also causes mess in our side. ... Please try cherry-picking

I will stop adding PRs to searx-next .. as long as I do not have a more comfortable method than cherry-pickng / I have to think about it .. remarks & hints are welcome ..

[asciimoo]

What is exactly the problem with cherry-pick? I think it's quite convenient to create a clear feature branch, pick some commits and create/update the PR, you can even rebase that branch without conlficting with your searx-next branch.

[return42]

@asciimoo thanks for taking up the brainstorm with me .. I have a doubt that a understand your suggestions. Some word to clarify ..

On the one side; I understand that you like to see a branch cleared up before merge into master. In my self-next branch there are two PRs open which not have been merged into asciimoo/master (#1985 and #1938). I can clean up theses branches if I got the OK for a merge. Since there are not many clones from searx--next exists, it should also OK to rebase searx-next in context of this both PRs .. I think this problem is solved.

On the other side, I want to progress with brainstorming about maintaining a branch like searx-next.

The motivation of the searx-next branch is to have a branch with a reference installation and this branch should also a testing area for PRs (other branches) before I (we) merge them into asciimoo/master . For smaller PRs without any special in, we do not need such a reference installation but there are also examples where it is good to have one, e.g. when I try to fix CSP errors or just test some issue users added to our issue tracker (often, they use an unmaintained instance and the reported bug have already been fixed). BTW: is there a chance to have searx.me back?

What is exactly the problem with cherry-pick?

It does not track .. if you have a bunch of PRs (branches) which are patched in the review phase, you have to track all branches manual.

I think it's quite convenient to create a clear feature branch, pick some commits and create/update the PR, you can even rebase that branch without conlficting with your searx-next branch.

I haven't understand in deep .. what I know (may I'm wrong) .. when you track a branch, and this branch is rebased or the history is changed in any manner, you lost the anchor where the external branch was started initial and than you do not have a chance to merge (pull) from that branch .. I'm wrong .. or did I misunderstood your suggestion?