Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Fetch avatar icons without a Referer
The icons came from Gravatar or Libravatar with the page's url as the
Referer, so the service learned which repositories and commits each
visitor looked at.
Diffstat (limited to 'custom/extensions/email-libravatar.lua')
| -rw-r--r-- | custom/extensions/email-libravatar.lua | 6 |
1 file changed, 5 insertions, 1 deletion
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua index edf4733..835b48f 100644 --- a/custom/extensions/email-libravatar.lua +++ b/custom/extensions/email-libravatar.lua @@ -5,6 +5,10 @@ -- -- email-filter=lua:/path/to/email-libravatar.lua -- +-- The visitor's browser fetches each icon from Libravatar, which learns the +-- hash of the address and the visitor's IP address, but not the page, since +-- the icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -132,7 +136,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end |