Page MenuHomeMiraheze

wgRightsIcon for GPLv3 blocked by CSP
Closed, ResolvedPublic

Description

Main_Page:1 Refused to load the image 'https://www.gnu.org/graphics/gplv3-or-later.png' because it violates the following Content Security Policy directive: "default-src 'self' blob: data:  *.miraheze.org *.wikimedia.org *.wikipedia.org *.wikibooks.org *.wiktionary.org *.wikiquote.org *.wikisource.org *.wikiversity.org *.wikinews.org *.wikivoyage.org *.mediawiki.org mediawiki.org *.wikidata.org wikidata.org *.wmflabs.org *.google.com *.gstatic.com *.addthis.com *.youtube.com *.youtube-nocookie.com maxcdn.bootstrapcdn.com twitter.com *.creativecommons.org images.uncyc.org www.mikrodev.com *.reviservices.com *.twitter.com www.sciencedaily.com *.googleapis.com *.twimg.com discordapp.com *.tile.openstreetmap.org *.freenode.net *.sorcery.net *.fontawesome.com *.a.wmflabs.org nenawiki.org *.cloudytheology.com i.imgur.com na.llnet.sims3store.cdn.ea.com cdn.discordapp.com m.media-amazon.com image.tmdb.org *.stripe.com *.twitch.tv *.fastly.net *.facebook.com *.shields.io *.bilibili.com *.163.com discord.com googleusercontent.com imgbox.com cdnjs.cloudflare.com cdn.jsdelivr.net reddit.com *.reddit.com redd.it *.redd.it redditmedia.com *.redditmedia.com dropbox.com *.dropbox.com dropboxstatic.com *.dropboxstatic.com disqus.com *.disqus.com *.nicovideo.jp lh3.googleusercontent.com db.onlinewebfonts.com wikiapiary.com *.vimeo.com *.googleusercontent.com *.imgbox.com 'unsafe-inline' 'unsafe-eval'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

We load content from www.gnu.org in https://github.com/miraheze/mw-config/blob/master/LocalWiki.php#L240 on some wikis but the site isn't whitelisted.

Event Timeline

Redmin triaged this task as Normal priority.Sep 26 2020, 20:57
Redmin created this task.
RhinosF1 renamed this task from HTML Bug Violating Content Security Policy to wgRightsIcon for GPLv3 blocked by CSP.Sep 26 2020, 21:06

Most browsers had an update quite a long time ago which is causing this issue. An example wiki affected by this- Snap! Wiki.

Nothing to do with a browser update, it's our own bad config.

Most browsers had an update quite a long time ago which is causing this issue. An example wiki affected by this- Snap! Wiki.

Nothing to do with a browser update, it's our own bad config.

This behaviour was not there before.

In T6232#121852, @R4356th wrote:

Most browsers had an update quite a long time ago which is causing this issue. An example wiki affected by this- Snap! Wiki.

Nothing to do with a browser update, it's our own bad config.

This behaviour was not there before.

This should have been an issue since whenever you switched the license to gpl-v3

CSP has been enforced throughout it existing. Did you regularly check the console? For the rights icon existing?

/me actually remembers mentioning this issue when he added that config.

I cannot be sure but I have a feeling that the image was being loaded properly.

John claimed this task.