From d55bfcdc3f3b49736837a6b568bda576bdb8c68c Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 6 Nov 2026 23:00:24 -1000 Subject: Fetch avatar icons without a Referer The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at. --- custom/extensions/email-gravatar.lua | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'custom/extensions/email-gravatar.lua') diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index 23fb508..622196f 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -6,6 +6,10 @@ -- -- email-filter=lua:/path/to/email-gravatar.lua -- +-- The visitor's browser fetches each icon from Gravatar, which learns the hash +-- of the address and the visitor's IP address, but not the page, since the +-- icon is fetched without a Referer. +-- -- Runs on Lua 5.1 through 5.5 and LuaJIT, where 5.5 needs luaossl 20260910 or -- later, or a build patched for 5.5 such as Alpine's, since earlier releases -- fail to load there. @@ -133,7 +137,7 @@ function filter_close() "' srcset='" .. avatar_url(avatar_size * 2) .. " 2x" .. "' alt='' width='" .. avatar_size .. "' height='" .. avatar_size .. - "' loading='lazy' decoding='async'> " .. text) + "' loading='lazy' decoding='async' referrerpolicy='no-referrer'> " .. text) end return 0 end -- cgit 2.12.1