X-Git-Url: https://git.danieliu.xyz/?p=surf.git;a=blobdiff_plain;f=surf.c;h=fcaa506639d4f2de07212c60d67ab7caafedd898;hp=2a05bf7b7c66f139481fd0cd602a5cb3c1c6b0a3;hb=0d1e670ac3e6a5ea02ff1c6a6e64263b425aef9c;hpb=75e3fe5b95bc94d5309bd78d9cc98f0034595c3e

diff --git a/surf.c b/surf.c
index 2a05bf7..fcaa506 100644
--- a/surf.c
+++ b/surf.c
@@ -31,14 +31,18 @@
 
 #define LENGTH(x)               (sizeof(x) / sizeof(x[0]))
 #define CLEANMASK(mask)         (mask & (MODKEY|GDK_SHIFT_MASK))
-#define SETB(p, s)              [p] = (Parameter){ { .b = s }, }
-#define SETI(p, s)              [p] = (Parameter){ { .i = s }, }
-#define SETV(p, s)              [p] = (Parameter){ { .v = s }, }
-#define SETF(p, s)              [p] = (Parameter){ { .f = s }, }
-#define FSETB(p, s)             [p] = (Parameter){ { .b = s }, 1 }
-#define FSETI(p, s)             [p] = (Parameter){ { .i = s }, 1 }
-#define FSETV(p, s)             [p] = (Parameter){ { .v = s }, 1 }
-#define FSETF(p, s)             [p] = (Parameter){ { .f = s }, 1 }
+#define SETB(p, s)              [p] = { { .b = s }, }
+#define SETI(p, s)              [p] = { { .i = s }, }
+#define SETV(p, s)              [p] = { { .v = s }, }
+#define SETF(p, s)              [p] = { { .f = s }, }
+#define FSETB(p, s)             [p] = { { .b = s }, 1 }
+#define FSETI(p, s)             [p] = { { .i = s }, 1 }
+#define FSETV(p, s)             [p] = { { .v = s }, 1 }
+#define FSETF(p, s)             [p] = { { .f = s }, 1 }
+#define CSETB(p, s)             [p] = (Parameter){ { .b = s }, 1 }
+#define CSETI(p, s)             [p] = (Parameter){ { .i = s }, 1 }
+#define CSETV(p, s)             [p] = (Parameter){ { .v = s }, 1 }
+#define CSETF(p, s)             [p] = (Parameter){ { .f = s }, 1 }
 
 enum { AtomFind, AtomGo, AtomUri, AtomLast };
 
@@ -54,7 +58,9 @@ enum {
 };
 
 typedef enum {
+	AcceleratedCanvas,
 	CaretBrowsing,
+	Certificate,
 	CookiePolicies,
 	DiskCache,
 	DNSPrefetch,
@@ -66,14 +72,16 @@ typedef enum {
 	JavaScript,
 	KioskMode,
 	LoadImages,
+	MediaManualPlay,
 	Plugins,
 	PreferredLanguages,
 	RunInFullscreen,
 	ScrollBars,
 	ShowIndicators,
+	SiteQuirks,
 	SpellChecking,
 	SpellLanguages,
-	StrictSSL,
+	StrictTLS,
 	Style,
 	ZoomLevel,
 	ParameterLast,
@@ -97,9 +105,9 @@ typedef struct Client {
 	WebKitWebInspector *inspector;
 	WebKitFindController *finder;
 	WebKitHitTestResult *mousepos;
-	GTlsCertificateFlags tlsflags;
+	GTlsCertificateFlags tlserr;
 	Window xid;
-	int progress, fullscreen;
+	int progress, fullscreen, https, insecure;
 	const char *title, *overtitle, *targeturi;
 	const char *needle;
 	struct Client *next;
@@ -129,17 +137,20 @@ typedef struct {
 
 typedef struct {
 	char *regex;
-	char *style;
+	char *file;
 	regex_t re;
-} SiteStyle;
+} SiteSpecific;
 
 /* Surf */
 static void usage(void);
 static void die(const char *errstr, ...);
 static void setup(void);
 static void sigchld(int unused);
+static void sighup(int unused);
 static char *buildfile(const char *path);
 static char *buildpath(const char *path);
+static const char *getuserhomedir(const char *user);
+static const char *getcurrentuserhomedir(void);
 static Client *newclient(Client *c);
 static void loaduri(Client *c, const Arg *a);
 static const char *geturi(Client *c);
@@ -152,8 +163,10 @@ static WebKitCookieAcceptPolicy cookiepolicy_get(void);
 static char cookiepolicy_set(const WebKitCookieAcceptPolicy p);
 static void seturiparameters(Client *c, const char *uri);
 static void setparameter(Client *c, int refresh, ParamName p, const Arg *a);
+static const char *getcert(const char *uri);
+static void setcert(Client *c, const char *file);
 static const char *getstyle(const char *uri);
-static void setstyle(Client *c, const char *stylefile);
+static void setstyle(Client *c, const char *file);
 static void runscript(Client *c);
 static void evalscript(Client *c, const char *jsstr, ...);
 static void updatewinid(Client *c);
@@ -164,8 +177,8 @@ static void destroyclient(Client *c);
 static void cleanup(void);
 
 /* GTK/WebKit */
-static GdkDevice *getkbdevice(void);
 static WebKitWebView *newview(Client *c, WebKitWebView *rv);
+static void initwebextensions(WebKitWebContext *wc, Client *c);
 static GtkWidget *createview(WebKitWebView *v, WebKitNavigationAction *a,
                              Client *c);
 static gboolean buttonreleased(GtkWidget *w, GdkEvent *e, Client *c);
@@ -186,6 +199,8 @@ static gboolean decidepolicy(WebKitWebView *v, WebKitPolicyDecision *d,
 static void decidenavigation(WebKitPolicyDecision *d, Client *c);
 static void decidenewwindow(WebKitPolicyDecision *d, Client *c);
 static void decideresource(WebKitPolicyDecision *d, Client *c);
+static void insecurecontent(WebKitWebView *v, WebKitInsecureContentEvent e,
+                            Client *c);
 static void downloadstarted(WebKitWebContext *wc, WebKitDownload *d,
                             Client *c);
 static void responsereceived(WebKitDownload *d, GParamSpec *ps, Client *c);
@@ -214,7 +229,7 @@ static void clicknewwindow(Client *c, const Arg *a, WebKitHitTestResult *h);
 static void clickexternplayer(Client *c, const Arg *a, WebKitHitTestResult *h);
 
 static char winid[64];
-static char togglestats[10];
+static char togglestats[11];
 static char pagestats[2];
 static Atom atoms[AtomLast];
 static Window embed;
@@ -234,8 +249,8 @@ char *argv0;
 void
 usage(void)
 {
-	die("usage: %s [-bBdDfFgGiIkKmMnNpPsSvx] [-a cookiepolicies ] "
-	    "[-c cookiefile] [-e xid] [-r scriptfile] [-t stylefile] "
+	die("usage: %s [-bBdDfFgGiIkKmMnNpPsStTvx] [-a cookiepolicies ] "
+	    "[-c cookiefile] [-C stylefile] [-e xid] [-r scriptfile] "
 	    "[-u useragent] [-z zoomlevel] [uri]\n", basename(argv0));
 }
 
@@ -253,40 +268,59 @@ die(const char *errstr, ...)
 void
 setup(void)
 {
+	GdkDisplay *gdpy;
 	int i, j;
 
 	/* clean up any zombies immediately */
 	sigchld(0);
-	gtk_init(NULL, NULL);
+	if (signal(SIGHUP, sighup) == SIG_ERR)
+		die("Can't install SIGHUP handler");
 
-	dpy = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
-
-	curconfig = defconfig;
+	if (!(dpy = XOpenDisplay(NULL)))
+		die("Can't open default display");
 
 	/* atoms */
 	atoms[AtomFind] = XInternAtom(dpy, "_SURF_FIND", False);
 	atoms[AtomGo] = XInternAtom(dpy, "_SURF_GO", False);
 	atoms[AtomUri] = XInternAtom(dpy, "_SURF_URI", False);
 
+	gtk_init(NULL, NULL);
+
+	gdpy = gdk_display_get_default();
+
+	curconfig = defconfig;
+
 	/* dirs and files */
 	cookiefile = buildfile(cookiefile);
 	scriptfile = buildfile(scriptfile);
 	cachedir   = buildpath(cachedir);
+	certdir    = buildpath(certdir);
 
-	gdkkb = getkbdevice();
+	gdkkb = gdk_seat_get_keyboard(gdk_display_get_default_seat(gdpy));
+
+	for (i = 0; i < LENGTH(certs); ++i) {
+		if (!regcomp(&(certs[i].re), certs[i].regex, REG_EXTENDED)) {
+			certs[i].file = g_strconcat(certdir, "/", certs[i].file,
+			                            NULL);
+		} else {
+			fprintf(stderr, "Could not compile regex: %s\n",
+			        certs[i].regex);
+			certs[i].regex = NULL;
+		}
+	}
 
 	if (!stylefile) {
 		styledir = buildpath(styledir);
 		for (i = 0; i < LENGTH(styles); ++i) {
-			if (regcomp(&(styles[i].re), styles[i].regex,
+			if (!regcomp(&(styles[i].re), styles[i].regex,
 			    REG_EXTENDED)) {
-				fprintf(stderr,
-				        "Could not compile regex: %s\n",
+				styles[i].file = g_strconcat(styledir, "/",
+				                    styles[i].file, NULL);
+			} else {
+				fprintf(stderr, "Could not compile regex: %s\n",
 				        styles[i].regex);
 				styles[i].regex = NULL;
 			}
-			styles[i].style = g_strconcat(styledir, "/",
-			                              styles[i].style, NULL);
 		}
 		g_free(styledir);
 	} else {
@@ -304,8 +338,7 @@ setup(void)
 					uriparams[i].config[j] = defconfig[j];
 			}
 		} else {
-			fprintf(stderr,
-			        "Could not compile regex: %s\n",
+			fprintf(stderr, "Could not compile regex: %s\n",
 			        uriparams[i].uri);
 			uriparams[i].uri = NULL;
 		}
@@ -321,6 +354,16 @@ sigchld(int unused)
 		;
 }
 
+void
+sighup(int unused)
+{
+	Arg a = { .b = 0 };
+	Client *c;
+
+	for (c = clients; c; c = c->next)
+		reload(c, &a);
+}
+
 char *
 buildfile(const char *path)
 {
@@ -346,29 +389,59 @@ buildfile(const char *path)
 	return fpath;
 }
 
+static const char*
+getuserhomedir(const char *user)
+{
+	struct passwd *pw = getpwnam(user);
+
+	if (!pw)
+		die("Can't get user %s login information.\n", user);
+
+	return pw->pw_dir;
+}
+
+static const char*
+getcurrentuserhomedir(void)
+{
+	const char *homedir;
+	const char *user;
+	struct passwd *pw;
+
+	homedir = getenv("HOME");
+	if (homedir)
+		return homedir;
+
+	user = getenv("USER");
+	if (user)
+		return getuserhomedir(user);
+
+	pw = getpwuid(getuid());
+	if (!pw)
+		die("Can't get current user home directory\n");
+
+	return pw->pw_dir;
+}
+
 char *
 buildpath(const char *path)
 {
-	struct passwd *pw;
 	char *apath, *name, *p, *fpath;
+	const char *homedir;
 
 	if (path[0] == '~') {
 		if (path[1] == '/' || path[1] == '\0') {
 			p = (char *)&path[1];
-			pw = getpwuid(getuid());
+			homedir = getcurrentuserhomedir();
 		} else {
 			if ((p = strchr(path, '/')))
 				name = g_strndup(&path[1], --p - path);
 			else
 				name = g_strdup(&path[1]);
 
-			if (!(pw = getpwnam(name))) {
-				die("Can't get user %s home directory: %s.\n",
-				    name, path);
-			}
+			homedir = getuserhomedir(name);
 			g_free(name);
 		}
-		apath = g_build_filename(pw->pw_dir, p, NULL);
+		apath = g_build_filename(homedir, p, NULL);
 	} else {
 		apath = g_strdup(path);
 	}
@@ -395,7 +468,6 @@ newclient(Client *rc)
 	clients = c;
 
 	c->progress = 100;
-	c->tlsflags = G_TLS_CERTIFICATE_VALIDATE_ALL + 1;
 	c->view = newview(c, rc ? rc->view : NULL);
 
 	return c;
@@ -411,7 +483,10 @@ loaduri(Client *c, const Arg *a)
 	if (g_strcmp0(uri, "") == 0)
 		return;
 
-	if (g_strrstr(uri, "://") || g_str_has_prefix(uri, "about:")) {
+	if (g_str_has_prefix(uri, "http://")  ||
+	    g_str_has_prefix(uri, "https://") ||
+	    g_str_has_prefix(uri, "file://")  ||
+	    g_str_has_prefix(uri, "about:")) {
 		url = g_strdup(uri);
 	} else if (!stat(uri, &st) && (path = realpath(uri, NULL))) {
 		url = g_strdup_printf("file://%s", path);
@@ -508,14 +583,17 @@ gettogglestats(Client *c)
 	togglestats[6] = curconfig[Plugins].val.b ?         'V' : 'v';
 	togglestats[7] = curconfig[Style].val.b ?           'M' : 'm';
 	togglestats[8] = curconfig[FrameFlattening].val.b ? 'F' : 'f';
-	togglestats[9] = '\0';
+	togglestats[9] = curconfig[StrictTLS].val.b ?       'T' : 't';
+	togglestats[10] = '\0';
 }
 
 void
 getpagestats(Client *c)
 {
-	pagestats[0] = c->tlsflags > G_TLS_CERTIFICATE_VALIDATE_ALL ? '-' :
-	               c->tlsflags > 0 ? 'U' : 'T';
+	if (c->https)
+		pagestats[0] = (c->tlserr || c->insecure) ?  'U' : 'T';
+	else
+		pagestats[0] = '-';
 	pagestats[1] = '\0';
 }
 
@@ -567,13 +645,21 @@ seturiparameters(Client *c, const char *uri)
 void
 setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 {
+	GdkRGBA bgcolor = { 0 };
 	WebKitSettings *s = webkit_web_view_get_settings(c->view);
 
 	switch (p) {
+	case AcceleratedCanvas:
+		webkit_settings_set_enable_accelerated_2d_canvas(s, a->b);
+		break;
 	case CaretBrowsing:
 		webkit_settings_set_enable_caret_browsing(s, a->b);
 		refresh = 0;
 		break;
+	case Certificate:
+		if (a->b)
+			setcert(c, geturi(c));
+		return; /* do not update */
 	case CookiePolicies:
 		webkit_cookie_manager_set_accept_policy(
 		    webkit_web_context_get_cookie_manager(
@@ -583,28 +669,29 @@ setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 		break;
 	case DiskCache:
 		webkit_web_context_set_cache_model(
-		    webkit_web_view_get_context(c->view),
-		    curconfig[DiskCache].val.b ?
+		    webkit_web_view_get_context(c->view), a->b ?
 		    WEBKIT_CACHE_MODEL_WEB_BROWSER :
 		    WEBKIT_CACHE_MODEL_DOCUMENT_VIEWER);
-		break;
+		return; /* do not update */
 	case DNSPrefetch:
-		refresh = 0;
-		break;
+		webkit_settings_set_enable_dns_prefetching(s, a->b);
+		return; /* do not update */
 	case FontSize:
-		webkit_settings_set_default_font_size(
-		    webkit_web_view_get_settings(c->view),
-		    curconfig[FontSize].val.i);
-		break;
+		webkit_settings_set_default_font_size(s, a->i);
+		return; /* do not update */
 	case FrameFlattening:
 		webkit_settings_set_enable_frame_flattening(s, a->b);
 		break;
 	case Geolocation:
+		refresh = 0;
 		break;
 	case HideBackground:
-		return; /* do nothing */
+		if (a->b)
+			webkit_web_view_set_background_color(c->view, &bgcolor);
+		return; /* do not update */
 	case Inspector:
-		return; /* do nothing */
+		webkit_settings_set_enable_developer_extras(s, a->b);
+		return; /* do not update */
 	case JavaScript:
 		webkit_settings_set_enable_javascript(s, a->b);
 		break;
@@ -613,6 +700,9 @@ setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 	case LoadImages:
 		webkit_settings_set_auto_load_images(s, a->b);
 		break;
+	case MediaManualPlay:
+		webkit_settings_set_media_playback_requires_user_gesture(s, a->b);
+		break;
 	case Plugins:
 		webkit_settings_set_enable_plugins(s, a->b);
 		break;
@@ -627,25 +717,26 @@ setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 		evalscript(c, "document.documentElement.style.overflow = '%s'",
 		    enablescrollbars ? "auto" : "hidden");
 		*/
-		refresh = 0;
-		break;
+		return; /* do not update */
 	case ShowIndicators:
-		return; /* do nothing */
+		break;
+	case SiteQuirks:
+		webkit_settings_set_enable_site_specific_quirks(s, a->b);
+		break;
 	case SpellChecking:
 		webkit_web_context_set_spell_checking_enabled(
-		    webkit_web_view_get_context(c->view),
-		    curconfig[SpellChecking].val.b);
-		return; /* do nothing */
+		    webkit_web_view_get_context(c->view), a->b);
+		return; /* do not update */
 	case SpellLanguages:
 		return; /* do nothing */
-	case StrictSSL:
+	case StrictTLS:
 		webkit_web_context_set_tls_errors_policy(
-		    webkit_web_view_get_context(c->view),
-		    curconfig[StrictSSL].val.b ? WEBKIT_TLS_ERRORS_POLICY_FAIL :
+		    webkit_web_view_get_context(c->view), a->b ?
+		    WEBKIT_TLS_ERRORS_POLICY_FAIL :
 		    WEBKIT_TLS_ERRORS_POLICY_IGNORE);
-		return; /* do nothing */
+		break;
 	case Style:
-		if (curconfig[Style].val.b)
+		if (a->b)
 			setstyle(c, getstyle(geturi(c)));
 		else
 			webkit_user_content_manager_remove_all_style_sheets(
@@ -653,7 +744,8 @@ setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 		refresh = 0;
 		break;
 	case ZoomLevel:
-		return; /* do nothing */
+		webkit_web_view_set_zoom_level(c->view, a->f);
+		return; /* do not update */
 	default:
 		return; /* do nothing */
 	}
@@ -663,6 +755,44 @@ setparameter(Client *c, int refresh, ParamName p, const Arg *a)
 		reload(c, a);
 }
 
+const char *
+getcert(const char *uri)
+{
+	int i;
+
+	for (i = 0; i < LENGTH(certs); ++i) {
+		if (certs[i].regex &&
+		    !regexec(&(certs[i].re), uri, 0, NULL, 0))
+			return certs[i].file;
+	}
+
+	return NULL;
+}
+
+void
+setcert(Client *c, const char *uri)
+{
+	const char *file = getcert(uri);
+	char *host;
+	GTlsCertificate *cert;
+
+	if (!file)
+		return;
+
+	if (!(cert = g_tls_certificate_new_from_file(file, NULL))) {
+		fprintf(stderr, "Could not read certificate file: %s\n", file);
+		return;
+	}
+
+	uri = strstr(uri, "://") + sizeof("://") - 1;
+	host = strndup(uri, strstr(uri, "/") - uri);
+
+	webkit_web_context_allow_tls_certificate_for_host(
+	    webkit_web_view_get_context(c->view), cert, host);
+
+	free(host);
+}
+
 const char *
 getstyle(const char *uri)
 {
@@ -674,19 +804,19 @@ getstyle(const char *uri)
 	for (i = 0; i < LENGTH(styles); ++i) {
 		if (styles[i].regex &&
 		    !regexec(&(styles[i].re), uri, 0, NULL, 0))
-			return styles[i].style;
+			return styles[i].file;
 	}
 
 	return "";
 }
 
 void
-setstyle(Client *c, const char *stylefile)
+setstyle(Client *c, const char *file)
 {
 	gchar *style;
 
-	if (!g_file_get_contents(stylefile, &style, NULL, NULL)) {
-		fprintf(stderr, "Could not read style file: %s\n", stylefile);
+	if (!g_file_get_contents(file, &style, NULL, NULL)) {
+		fprintf(stderr, "Could not read style file: %s\n", file);
 		return;
 	}
 
@@ -743,7 +873,7 @@ newwindow(Client *c, const Arg *a, int noembed)
 {
 	int i = 0;
 	char tmp[64];
-	const char *cmd[26], *uri;
+	const char *cmd[28], *uri;
 	const Arg arg = { .v = cmd };
 
 	cmd[i++] = argv0;
@@ -754,6 +884,10 @@ newwindow(Client *c, const Arg *a, int noembed)
 		cmd[i++] = "-c";
 		cmd[i++] = cookiefile;
 	}
+	if (stylefile && g_strcmp0(stylefile, "")) {
+		cmd[i++] = "-C";
+		cmd[i++] = stylefile;
+	}
 	cmd[i++] = curconfig[DiskCache].val.b ? "-D" : "-d";
 	if (embed && !noembed) {
 		cmd[i++] = "-e";
@@ -772,10 +906,7 @@ newwindow(Client *c, const Arg *a, int noembed)
 		cmd[i++] = scriptfile;
 	}
 	cmd[i++] = curconfig[JavaScript].val.b ? "-S" : "-s";
-	if (stylefile && g_strcmp0(stylefile, "")) {
-		cmd[i++] = "-t";
-		cmd[i++] = stylefile;
-	}
+	cmd[i++] = curconfig[StrictTLS].val.b ? "-T" : "-t";
 	if (fulluseragent && g_strcmp0(fulluseragent, "")) {
 		cmd[i++] = "-u";
 		cmd[i++] = fulluseragent;
@@ -833,22 +964,7 @@ cleanup(void)
 	g_free(scriptfile);
 	g_free(stylefile);
 	g_free(cachedir);
-}
-
-static GdkDevice *
-getkbdevice(void)
-{
-	GList *l, *gdl = gdk_device_manager_list_devices(
-	           gdk_display_get_device_manager(gdk_display_get_default()),
-		   GDK_DEVICE_TYPE_MASTER);
-	GdkDevice *gd = NULL;
-
-	for (l = gdl; l != NULL; l = l->next)
-		if (gdk_device_get_source(l->data) == GDK_SOURCE_KEYBOARD)
-			gd = l->data;
-
-	g_list_free(gdl);
-	return gd;
+	XCloseDisplay(dpy);
 }
 
 WebKitWebView *
@@ -866,7 +982,7 @@ newview(Client *c, WebKitWebView *rv)
 	} else {
 		settings = webkit_settings_new_with_settings(
 		   "auto-load-images", curconfig[LoadImages].val.b,
-		   "default-font-size", curconfig[FontSize].val.f,
+		   "default-font-size", curconfig[FontSize].val.i,
 		   "enable-caret-browsing", curconfig[CaretBrowsing].val.b,
 		   "enable-developer-extras", curconfig[Inspector].val.b,
 		   "enable-dns-prefetching", curconfig[DNSPrefetch].val.b,
@@ -875,6 +991,9 @@ newview(Client *c, WebKitWebView *rv)
 		   "enable-html5-local-storage", curconfig[DiskCache].val.b,
 		   "enable-javascript", curconfig[JavaScript].val.b,
 		   "enable-plugins", curconfig[Plugins].val.b,
+		   "enable-accelerated-2d-canvas", curconfig[AcceleratedCanvas].val.b,
+		   "enable-site-specific-quirks", curconfig[SiteQuirks].val.b,
+		   "media-playback-requires-user-gesture", curconfig[MediaManualPlay].val.b,
 		   NULL);
 /* For mor interesting settings, have a look at
  * http://webkitgtk.org/reference/webkit2gtk/stable/WebKitSettings.html */
@@ -899,9 +1018,9 @@ newview(Client *c, WebKitWebView *rv)
 		 * or one for each view */
 		webkit_web_context_set_process_model(context,
 		    WEBKIT_PROCESS_MODEL_MULTIPLE_SECONDARY_PROCESSES);
-		/* ssl */
+		/* TLS */
 		webkit_web_context_set_tls_errors_policy(context,
-		    curconfig[StrictSSL].val.b ? WEBKIT_TLS_ERRORS_POLICY_FAIL :
+		    curconfig[StrictTLS].val.b ? WEBKIT_TLS_ERRORS_POLICY_FAIL :
 		    WEBKIT_TLS_ERRORS_POLICY_IGNORE);
 		/* disk cache */
 		webkit_web_context_set_cache_model(context,
@@ -926,6 +1045,8 @@ newview(Client *c, WebKitWebView *rv)
 
 		g_signal_connect(G_OBJECT(context), "download-started",
 		                 G_CALLBACK(downloadstarted), c);
+		g_signal_connect(G_OBJECT(context), "initialize-web-extensions",
+		                 G_CALLBACK(initwebextensions), c);
 
 		v = g_object_new(WEBKIT_TYPE_WEB_VIEW,
 		    "settings", settings,
@@ -946,6 +1067,8 @@ newview(Client *c, WebKitWebView *rv)
 			 G_CALLBACK(createview), c);
 	g_signal_connect(G_OBJECT(v), "decide-policy",
 			 G_CALLBACK(decidepolicy), c);
+	g_signal_connect(G_OBJECT(v), "insecure-content-detected",
+			 G_CALLBACK(insecurecontent), c);
 	g_signal_connect(G_OBJECT(v), "load-changed",
 			 G_CALLBACK(loadchanged), c);
 	g_signal_connect(G_OBJECT(v), "mouse-target-changed",
@@ -958,6 +1081,12 @@ newview(Client *c, WebKitWebView *rv)
 	return v;
 }
 
+void
+initwebextensions(WebKitWebContext *wc, Client *c)
+{
+	webkit_web_context_set_web_extensions_directory(wc, WEBEXTDIR);
+}
+
 GtkWidget *
 createview(WebKitWebView *v, WebKitNavigationAction *a, Client *c)
 {
@@ -1079,8 +1208,7 @@ showview(WebKitWebView *v, Client *c)
 	GdkWindow *gwin;
 
 	c->finder = webkit_web_view_get_find_controller(c->view);
-	if (curconfig[Inspector].val.b)
-		c->inspector = webkit_web_view_get_inspector(c->view);
+	c->inspector = webkit_web_view_get_inspector(c->view);
 
 	c->win = createwindow(c);
 
@@ -1135,7 +1263,7 @@ createwindow(Client *c)
 		gtk_window_set_role(GTK_WINDOW(w), wmstr);
 		g_free(wmstr);
 
-		gtk_window_set_default_size(GTK_WINDOW(w), 800, 600);
+		gtk_window_set_default_size(GTK_WINDOW(w), winsize[0], winsize[1]);
 	}
 
 	g_signal_connect(G_OBJECT(w), "destroy",
@@ -1162,21 +1290,17 @@ loadchanged(WebKitWebView *v, WebKitLoadEvent e, Client *c)
 		curconfig = defconfig;
 		setatom(c, AtomUri, title);
 		c->title = title;
-		c->tlsflags = G_TLS_CERTIFICATE_VALIDATE_ALL + 1;
+		c->https = c->insecure = 0;
+		seturiparameters(c, geturi(c));
 		break;
 	case WEBKIT_LOAD_REDIRECTED:
 		setatom(c, AtomUri, title);
 		c->title = title;
+		seturiparameters(c, geturi(c));
 		break;
 	case WEBKIT_LOAD_COMMITTED:
-		setatom(c, AtomUri, title);
-		c->title = title;
-		if (!webkit_web_view_get_tls_info(c->view, NULL,
-		    &(c->tlsflags)))
-			c->tlsflags = G_TLS_CERTIFICATE_VALIDATE_ALL + 1;
-
-		setatom(c, AtomUri, geturi(c));
-		seturiparameters(c, geturi(c));
+		c->https = webkit_web_view_get_tls_info(c->view, NULL,
+		                                        &c->tlserr);
 		break;
 	case WEBKIT_LOAD_FINISHED:
 		/* Disabled until we write some WebKitWebExtension for
@@ -1363,6 +1487,12 @@ decideresource(WebKitPolicyDecision *d, Client *c)
 	}
 }
 
+void
+insecurecontent(WebKitWebView *v, WebKitInsecureContentEvent e, Client *c)
+{
+	c->insecure = 1;
+}
+
 void
 downloadstarted(WebKitWebContext *wc, WebKitDownload *d, Client *c)
 {
@@ -1457,7 +1587,6 @@ scroll(Client *c, const Arg *a)
 	GdkEvent *ev = gdk_event_new(GDK_KEY_PRESS);
 
 	gdk_event_set_device(ev, gdkkb);
-//	gdk_event_set_screen(ev, gdk_screen_get_default());
 	ev->key.window = gtk_widget_get_window(GTK_WIDGET(c->win));
 	ev->key.state = GDK_CONTROL_MASK;
 	ev->key.time = GDK_CURRENT_TIME;
@@ -1530,12 +1659,10 @@ togglecookiepolicy(Client *c, const Arg *a)
 void
 toggleinspector(Client *c, const Arg *a)
 {
-	if (curconfig[Inspector].val.b) {
-		if (webkit_web_inspector_is_attached(c->inspector))
-			webkit_web_inspector_close(c->inspector);
-		else
-			webkit_web_inspector_show(c->inspector);
-	}
+	if (webkit_web_inspector_is_attached(c->inspector))
+		webkit_web_inspector_close(c->inspector);
+	else if (curconfig[Inspector].val.b)
+		webkit_web_inspector_show(c->inspector);
 }
 
 void
@@ -1599,91 +1726,97 @@ main(int argc, char *argv[])
 	/* command line args */
 	ARGBEGIN {
 	case 'a':
-		defconfig FSETV(CookiePolicies, EARGF(usage()));
+		defconfig CSETV(CookiePolicies, EARGF(usage()));
 		break;
 	case 'b':
-		defconfig FSETB(ScrollBars, 0);
+		defconfig CSETB(ScrollBars, 0);
 		break;
 	case 'B':
-		defconfig FSETB(ScrollBars, 1);
+		defconfig CSETB(ScrollBars, 1);
 		break;
 	case 'c':
 		cookiefile = EARGF(usage());
 		break;
+	case 'C':
+		stylefile = EARGF(usage());
+		break;
 	case 'd':
-		defconfig FSETB(DiskCache, 0);
+		defconfig CSETB(DiskCache, 0);
 		break;
 	case 'D':
-		defconfig FSETB(DiskCache, 1);
+		defconfig CSETB(DiskCache, 1);
 		break;
 	case 'e':
 		embed = strtol(EARGF(usage()), NULL, 0);
 		break;
 	case 'f':
-		defconfig FSETB(RunInFullscreen, 0);
+		defconfig CSETB(RunInFullscreen, 0);
 		break;
 	case 'F':
-		defconfig FSETB(RunInFullscreen, 1);
+		defconfig CSETB(RunInFullscreen, 1);
 		break;
 	case 'g':
-		defconfig FSETB(Geolocation, 0);
+		defconfig CSETB(Geolocation, 0);
 		break;
 	case 'G':
-		defconfig FSETB(Geolocation, 1);
+		defconfig CSETB(Geolocation, 1);
 		break;
 	case 'i':
-		defconfig FSETB(LoadImages, 0);
+		defconfig CSETB(LoadImages, 0);
 		break;
 	case 'I':
-		defconfig FSETB(LoadImages, 1);
+		defconfig CSETB(LoadImages, 1);
 		break;
 	case 'k':
-		defconfig FSETB(KioskMode, 0);
+		defconfig CSETB(KioskMode, 0);
 		break;
 	case 'K':
-		defconfig FSETB(KioskMode, 1);
+		defconfig CSETB(KioskMode, 1);
 		break;
 	case 'm':
-		defconfig FSETB(Style, 0);
+		defconfig CSETB(Style, 0);
 		break;
 	case 'M':
-		defconfig FSETB(Style, 1);
+		defconfig CSETB(Style, 1);
 		break;
 	case 'n':
-		defconfig FSETB(Inspector, 0);
+		defconfig CSETB(Inspector, 0);
 		break;
 	case 'N':
-		defconfig FSETB(Inspector, 1);
+		defconfig CSETB(Inspector, 1);
 		break;
 	case 'p':
-		defconfig FSETB(Plugins, 0);
+		defconfig CSETB(Plugins, 0);
 		break;
 	case 'P':
-		defconfig FSETB(Plugins, 1);
+		defconfig CSETB(Plugins, 1);
 		break;
 	case 'r':
 		scriptfile = EARGF(usage());
 		break;
 	case 's':
-		defconfig FSETB(JavaScript, 0);
+		defconfig CSETB(JavaScript, 0);
 		break;
 	case 'S':
-		defconfig FSETB(JavaScript, 1);
+		defconfig CSETB(JavaScript, 1);
 		break;
 	case 't':
-		stylefile = EARGF(usage());
+		defconfig CSETB(StrictTLS, 0);
+		break;
+	case 'T':
+		defconfig CSETB(StrictTLS, 1);
 		break;
 	case 'u':
 		fulluseragent = EARGF(usage());
 		break;
 	case 'v':
-		die("surf-"VERSION", ©2009-2015 surf engineers, "
+		die("surf-"VERSION", ©2009-2017 surf engineers, "
 		    "see LICENSE for details\n");
 	case 'x':
 		showxid = 1;
 		break;
 	case 'z':
-		defconfig FSETF(ZoomLevel, strtof(EARGF(usage()), NULL));
+		defconfig CSETF(ZoomLevel, strtof(EARGF(usage()), NULL));
 		break;
 	default:
 		usage();