Merge branch 'master' of github.com:ornicar/lila

* 'master' of github.com:ornicar/lila:
  clarify secrets in base.conf, move one to application.conf.default
  put reminder that twitch must come last in csp
  update stockfish-mv.wasm to 0.5.2 (fixes variant piece values)

app/views/streamer/show.scala

@@ -29,7 +29,7 @@ object show {
           image = s.streamer.picturePath.map(p => dbImageUrl(p.value))
         )
         .some,
-      csp = defaultCsp.withTwitch.some
+      csp = defaultCsp.finalizeWithTwitch.some
     )(
       main(cls := "page-menu streamer-show")(
         st.aside(cls := "page-menu__menu")(

conf/application.conf.default

@@ -1,4 +1,7 @@
 include "base"
 include "version"
 
+# change for additional encryption of password hashes
+user.password.bpass.secret = "9qEYN0ThHer1KWLNekA76Q=="
+
 # override values from base.conf here

conf/base.conf

@@ -30,7 +30,7 @@ play {
       cookieName = "lila2"
       maxAge = 3650 days
     }
-    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^"
+    secret.key = "CiebwjgIM9cHQ;I?Xk:sfqDJ;BhIe:jsL?r=?IPF[saf>s^r0]?0grUq4>q?5mP^" # public (lila does not rely on cookie signing)
   }
   ws {
     useragent = "lichess.org"
@@ -413,9 +413,6 @@ user {
     trophyKind = trophyKind
     ranking = ranking
   }
-  password.bpass {
-    secret = "9qEYN0ThHer1KWLNekA76Q=="
-  }
 }
 fishnet {
   redis = ${redis}

modules/common/src/main/ContentSecurityPolicy.scala

@@ -26,7 +26,7 @@ case class ContentSecurityPolicy(
       frameSrc = "https://*.stripe.com" :: frameSrc
     )
 
-  def withTwitch =
+  def finalizeWithTwitch =
     copy(
       defaultSrc = Nil,
       connectSrc = "https://www.twitch.tv" :: "https://www-cdn.jtvnw.net" :: connectSrc,

ui/site/package.json

@@ -20,7 +20,7 @@
     "highcharts": "=4.2.5",
     "hopscotch": "^0.3.1",
     "jquery-bar-rating": "^1.2.2",
-    "stockfish-mv.wasm": "^0.5.1",
+    "stockfish-mv.wasm": "^0.5.2",
     "stockfish.js": "^10.0.2",
     "stockfish.wasm": "^0.9.1",
     "tablesort": "^5.1",

yarn.lock

@@ -4127,10 +4127,10 @@ stdout-stream@^1.4.0:
   dependencies:
     readable-stream "^2.0.1"
 
-stockfish-mv.wasm@^0.5.1:
-  version "0.5.1"
-  resolved "https://registry.yarnpkg.com/stockfish-mv.wasm/-/stockfish-mv.wasm-0.5.1.tgz#71c783d3417056263ff387eb043fd9b4d06e3e4f"
-  integrity sha512-iZA/m2Lkv1SBcCxDXcr+/PE4d4YhUoDgcj5G2P1EU0/3e4JMI0MkQTywMwcApy+pzDxphDv2bcjJRR33p9qmzQ==
+stockfish-mv.wasm@^0.5.2:
+  version "0.5.2"
+  resolved "https://registry.yarnpkg.com/stockfish-mv.wasm/-/stockfish-mv.wasm-0.5.2.tgz#08faca73ae2f5b69fb28bd04c20074e443cdaa7e"
+  integrity sha512-MujfrAVAzDkRoVEiYMkGaiAw9wei2hRR8sxD5l7emHDyCbmc0KdlqoIZtS+coQ9CVNaZa1o5JokTKJVv8wJhUQ==
 
 stockfish.js@^10.0.2:
   version "10.0.2"