X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=default.action.master;h=c642c7eafda994a1d6c96a0a34a9892211ba13a6;hp=802511ece877da01c9174bba81f27b21a0e70cd3;hb=aa48dc0c96a29aeb4298ee0529c8020c8a318289;hpb=7135dc52b45e35af20f591def09daf74e7993e05 diff --git a/default.action.master b/default.action.master index 802511ec..c642c7ea 100644 --- a/default.action.master +++ b/default.action.master @@ -9,17 +9,19 @@ # # File : $Source: /cvsroot/ijbswa/current/default.action.master,v $ # -# $Id: default.action.master,v 1.132 2008/08/02 12:43:40 fabiankeil Exp $ +# $Id: default.action.master,v 1.163 2009/02/09 18:39:08 fabiankeil Exp $ # -# Requires : This version requires Privoxy v3.0.9 or later due to +# Requires : This version requires Privoxy v3.0.11 or later due to # syntax changes. # # Purpose : Default actions file, see # http://www.privoxy.org/user-manual/actions-file.html. -# This file is subject to periodic updating. Local exceptions -# and enhancements are better placed in user.action. +# This file is subject to periodic updating. It is +# not supposed to be edited by the user. Local exceptions +# and enhancements are better placed in user.action, +# the match-all section has been moved to match-all.action. # -# Copyright : Written by and Copyright (C) 2001-2008 the +# Copyright : Written by and Copyright (C) 2001-2009 the # Privoxy team. http://www.privoxy.org/ # # Note: Updated versions of this file will be made available from time @@ -202,6 +204,11 @@ # Block this URL. Instead of forwarding the request, Privoxy will # send a "block" page containing the specified reason. # +# +change-x-forwarded-for{add} +# +change-x-forwarded-for{block} +# Adds or blocks the "X-Forwarded-For:" HTTP header in client +# requests. +# # +client-header-filter{name} # All client headers to which this action applies are filtered on-the-fly # through the specified regular expression based substitutions. @@ -312,7 +319,7 @@ # shockwave-flash: Kill embedded Shockwave Flash objects. # quicktime-kioskmode: Make Quicktime movies saveable. # fun: Text replacements for subversive browsing fun! -# crude-parental: Crude parental filtering. Note that this filter doesn't work reliable. +# crude-parental: Crude parental filtering. Note that this filter doesn't work reliably. # ie-exploits: Disable some known Internet Explorer bug exploits. # site-specifics: Cure for site-specific problems. Don't apply generally! # no-ping: Removes non-standard ping attributes in and tags. @@ -355,9 +362,6 @@ # servers. This can be used to prevent download menus for content you # prefer to view inside the browser, for example. # -# +hide-forwarded-for-headers -# Block any existing X-Forwarded-for header. -# # +hide-from-header{block} # +hide-from-header{spam@sittingduck.xqq} # If the browser sends a "From:" header containing your e-mail address, @@ -393,22 +397,24 @@ # (Don't change the version number from 1.0 - after all, why tell them?) # # +limit-connect{portlist} -# The CONNECT methods exists in HTTP to allow access to secure websites -# (https:// URLs) through proxies. It works very simply: The proxy -# connects to the server on the specified port, and then short-circuits -# its connections to the client and to the remote proxy. -# This can be a big security hole, since CONNECT-enabled proxies can -# be abused as TCP relays very easily. -# By default, i.e. in the absence of a +limit-connect action, Privoxy -# will only allow CONNECT requests to port 443, which is the standard port -# for https. -# If you want to allow CONNECT for more ports than that, or want to forbid -# CONNECT altogether, you can specify a comma separated list of ports and port -# ranges (the latter using dashes, with the minimum defaulting to 0 and max to 65K): -# -# +limit-connect{443} # This is the default and need no be specified. -# +limit-connect{80,443} # Ports 80 and 443 are OK. -# +limit-connect{-3, 7, 20-100, 500-} # Port less than 3, 7, 20 to 100, and above 500 are OK. +# +# By default, i.e. if no limit-connect action applies, Privoxy +# allows HTTP CONNECT requests to all ports. Use limit-connect +# if fine-grained control is desired for some or all destinations. +# The CONNECT methods exists in HTTP to allow access to secure websites +# ("https://" URLs) through proxies. It works very simply: the proxy +# connects to the server on the specified port, and then short-circuits +# its connections to the client and to the remote server. This means +# CONNECT-enabled proxies can be used as TCP relays very easily. Privoxy +# relays HTTPS traffic without seeing the decoded content. Websites can +# leverage this limitation to circumvent Privoxy's filters. By specifying +# an invalid port range you can disable HTTPS entirely. +# +# +limit-connect{443} # Only port 443 is OK. +# +limit-connect{80,443} # Ports 80 and 443 are OK. +# +limit-connect{-3, 7, 20-100, 500-} # Ports less than 3, 7, 20 to 100 and above 500 are OK. +# +limit-connect{-} # All ports are OK +# +limit-connect{,} # No HTTPS/SSL traffic is allowed # # +overwrite-last-modified{block} # +overwrite-last-modified{reset-to-request-time} @@ -430,7 +436,7 @@ # # +prevent-compression # Prevent the website from compressing the data. Some websites do -# that, which is a problem for Privoxy when build without zlib support, +# that, which is a problem for Privoxy when built without zlib support, # since +filter and +gif-deanimate will not work on compressed data. # Will slow down connections to those websites, though. # @@ -500,7 +506,7 @@ {{settings}} ############################################################################# #MASTER# COMMENT: The minimum Privoxy version: -for-privoxy-version=3.0.9 +for-privoxy-version=3.0.11 ############################################################################# # Aliases @@ -549,15 +555,75 @@ myfilters = +filter{html-annoyances} +filter{js-annoyances} +filter{all-popups # allow-ads = -block -filter{banners-by-size} -filter{banners-by-link} -############################################################################# -# Defaults -############################################################################# +################ +# +# Cautious settings -- safe for all sites, but offer little privacy protection +# { \ -+hide-forwarded-for-headers \ ++change-x-forwarded-for{block} \ +hide-from-header{block} \ +set-image-blocker{pattern} \ } -/ # Match all URLs +standard.Cautious + +################ +# +# Medium settings -- safe for most sites, with reasonable protection/damage tradeoff +# +{ \ ++change-x-forwarded-for{block} \ ++deanimate-gifs{last} \ ++filter{refresh-tags} \ ++filter{img-reorder} \ ++filter{banners-by-size} \ ++filter{webbugs} \ ++filter{jumping-windows} \ ++filter{ie-exploits} \ ++hide-from-header{block} \ ++hide-referrer{conditional-block} \ ++session-cookies-only \ ++set-image-blocker{pattern} \ +} +standard.Medium + +################ +# +# Advanced settings -- reasonable privacy protection but +# require some exceptions for trusted sites, most likely +# because of cookies or SSL. Also testing ground for +# new options. +# +# CAUTION: These settings can still be subverted by a +# misconfigured client that executes code from untrusted +# sources. +# +{ \ ++change-x-forwarded-for{block} \ ++client-header-tagger{css-requests} \ ++client-header-tagger{image-requests} \ ++crunch-if-none-match \ ++crunch-outgoing-cookies \ ++crunch-incoming-cookies \ ++deanimate-gifs{last} \ ++fast-redirects{check-decoded-url} \ ++filter{html-annoyances} \ ++filter{content-cookies} \ ++filter{refresh-tags} \ ++filter{img-reorder} \ ++filter{banners-by-size} \ ++filter{banners-by-link} \ ++filter{webbugs} \ ++filter{jumping-windows} \ ++filter{frameset-borders} \ ++filter{quicktime-kioskmode} \ ++hide-if-modified-since{-60} \ ++hide-from-header{block} \ ++hide-referrer{conditional-block} \ ++limit-connect{,} \ ++overwrite-last-modified{randomize} \ ++set-image-blocker{pattern} \ +} +standard.Advanced ############################################################################# # These extensions belong to images: @@ -576,7 +642,6 @@ allow-ads = -block -filter{banners-by-size} -filter{banners-by-link} # Generic block patterns by host: ############################################################################# {+block{Host matches generic block pattern.}} -#MASTER# DONT-VERIFY (generic) ad*. .*ads. #MASTER# REMARKS: removed .ad. 2007-12-18 HB @@ -600,7 +665,6 @@ metrics. # Generic unblockers by host: ############################################################################# {-block} -#MASTER# DONT-VERIFY (generic) adsl. ad[udmw]*. adbl*. @@ -610,7 +674,6 @@ adob*. adrenaline. adtp*. adv[oia]*. -#MASTER# REMARKS: Added 2008-02-08 HB adventure*. .*road*. .olympiad*. @@ -623,16 +686,14 @@ countr*. # Generic block patterns by path: ############################################################################# {+block{Path matches generic block pattern.}} -#MASTER# DONT-VERIFY (generic) /(.*/)?ad(\?|/|s|v|_?(image|se?rv|box)|cycle|rotate|mentor|click|f[ra]m|script|stream|fetch|log|space) # Blocked URL = http://www.example.org/adimage # Blocked URL = http://www.example.org/adspace /phpads(new)?/ /(.*/)?(ad|all|nn|db|promo(tion)?)?[-_]?banner -/(.*/)?(publicite|werbung|reklaa?m|annonse|maino(kset|nta|s)?/) +/(.*/)?(publicite|werbung|rekla(me|am)|annonse|maino(kset|nta|s)?/) /.*(count|track|compteur|(?