From 4b93e1768c2a789aea0c235b8186590db8880489 Mon Sep 17 00:00:00 2001
From: Rich <piemonkey@protonmail.ch>
Date: Thu, 9 Feb 2023 22:29:16 +0100
Subject: [PATCH 1/2] Auto-select document name on edit if it's still the
 default

A small convenience to enable clicking a document name and immediately
typing the name, if it hasn't been set already
---
 www/common/toolbar.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/www/common/toolbar.js b/www/common/toolbar.js
index a827364e6..c1595cd2c 100644
--- a/www/common/toolbar.js
+++ b/www/common/toolbar.js
@@ -764,6 +764,10 @@ MessengerUI, Messages, Pages) {
             $input.val(inputVal);
             $input.show();
             $input.focus();
+            if (inputVal === $input.attr('placeholder')) {
+                // Placeholder is the default name, select text to make editing easier
+                $input.select();
+            }
             $pencilIcon.hide();
             $saveIcon.show();
         };

From 50c84949c8f57c090b9c26224f97e590a0d380cf Mon Sep 17 00:00:00 2001
From: ansuz <git@ansuz.xyz>
Date: Mon, 13 Feb 2023 12:47:13 +0530
Subject: [PATCH 2/2] invert NGINX settings to forbid remote embedding by
 default

---
 docs/example.nginx.conf | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 16a26872c..ea1c45516 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -23,15 +23,12 @@ server {
     set $main_domain "your-main-domain.com";
     set $sandbox_domain "your-sandbox-domain.com";
 
-    # By default CryptPad allows remote domains to embed CryptPad documents in iframes.
-    # This behaviour can be blocked by changing $allowed_origins from "*" to the
-    # sandbox domain, which must be permitted to load content from the main domain
-    # in order for CryptPad to work as expected.
-    #
-    # An example is given below which can be uncommented if you want to block
-    # remote sites from including content from your server
-    set $allowed_origins "*";
-    # set $allowed_origins "https://${sandbox_domain}";
+    # By default CryptPad forbids remote domains from embedding CryptPad documents in iframes.
+    # The sandbox domain must always be permitted in order for the platform to function.
+    # If you wish to enable remote embedding you may change the value below to "*"
+    # as per the commented value.
+    set $allowed_origins "https://${sandbox_domain}";
+    #set $allowed_origins "*";
 
     # CryptPad's dynamic content (websocket traffic and encrypted blobs)
     # can be served over separate domains. Using dedicated domains (or subdomains)