web commit by JoshTriplett

2007-02-19 22:52:54 +00:00 · 2007-02-19 22:52:54 +00:00 · aa5c6c94fd
parent bed393066a
commit aa5c6c94fd
1 changed files with 1 additions and 0 deletions
--- a/doc/bugs/Please_don39t_refer_to_offsite_openid_image.mdwn
+++ b/doc/bugs/Please_don39t_refer_to_offsite_openid_image.mdwn
@ -0,0 +1 @@
+In style.css, please don't refer to the OpenID image on an external site.  This reference allows that site to track users of ikiwikis and other sites supporting OpenID.  Furthermore, this reference also opens up cross-site scripting vulnerabilities if the external site did something malicious.  If the image has a Free Software license, please include it in ikiwiki, in the basewiki (preferably converted from gif to png).  If the image does not have a Free Software license, please omit it, and allow users to choose to add it to their CSS themselves if they find the risks acceptable.  --[[JoshTriplett]]
				`@ -0,0 +1 @@`
				In style.css, please don't refer to the OpenID image on an external site. This reference allows that site to track users of ikiwikis and other sites supporting OpenID. Furthermore, this reference also opens up cross-site scripting vulnerabilities if the external site did something malicious. If the image has a Free Software license, please include it in ikiwiki, in the basewiki (preferably converted from gif to png). If the image does not have a Free Software license, please omit it, and allow users to choose to add it to their CSS themselves if they find the risks acceptable. --[[JoshTriplett]]