{"action":"closed","issue":{"url":"https://api.github.com/repos/mattermost/platform/issues/3157","repository_url":"https://api.github.com/repos/mattermost/platform","labels_url":"https://api.github.com/repos/mattermost/platform/issues/3157/labels{/name}","comments_url":"https://api.github.com/repos/mattermost/platform/issues/3157/comments","events_url":"https://api.github.com/repos/mattermost/platform/issues/3157/events","html_url":"https://github.com/mattermost/platform/issues/3157","id":157509291,"number":3157,"title":"Add `crossorigin=\"anonymous\"` to embedded images","user":{"login":"ThiefMaster","id":179599,"avatar_url":"https://avatars.githubusercontent.com/u/179599?v=3","gravatar_id":"","url":"https://api.github.com/users/ThiefMaster","html_url":"https://github.com/ThiefMaster","followers_url":"https://api.github.com/users/ThiefMaster/followers","following_url":"https://api.github.com/users/ThiefMaster/following{/other_user}","gists_url":"https://api.github.com/users/ThiefMaster/gists{/gist_id}","starred_url":"https://api.github.com/users/ThiefMaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThiefMaster/subscriptions","organizations_url":"https://api.github.com/users/ThiefMaster/orgs","repos_url":"https://api.github.com/users/ThiefMaster/repos","events_url":"https://api.github.com/users/ThiefMaster/events{/privacy}","received_events_url":"https://api.github.com/users/ThiefMaster/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-30T14:04:53Z","updated_at":"2016-06-03T13:25:15Z","closed_at":"2016-06-03T13:25:15Z","body":"Currently hotlinking an image that is behind HTTP authentication results in everyone (at least Firefox users) getting an ugly HTTP auth prompt. This could probably be used for phishing if your users are gullible enough.\r\n\r\nApparently `crossorigin=\"anonymous\"` on the `img` tag prevents this so it'd be a good idea if all img tags that are created by users (e.g. from markdown `![](url)`) had this attribute. Another option would be to proxy-load them and serve them via MM (that would also avoid mixed content when MM runs on https but the linked image is on http)"}}
{"actor":{"display_login":"hmhealey"}}