{"action":"opened","issue":{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12438","repository_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin","labels_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12438/labels{/name}","comments_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12438/comments","events_url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/issues/12438/events","html_url":"https://github.com/phpmyadmin/phpmyadmin/issues/12438","id":169090269,"number":12438,"title":"Possible policy issue with OSM tiles","user":{"login":"nijel","id":212189,"avatar_url":"https://avatars.githubusercontent.com/u/212189?v=3","gravatar_id":"","url":"https://api.github.com/users/nijel","html_url":"https://github.com/nijel","followers_url":"https://api.github.com/users/nijel/followers","following_url":"https://api.github.com/users/nijel/following{/other_user}","gists_url":"https://api.github.com/users/nijel/gists{/gist_id}","starred_url":"https://api.github.com/users/nijel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nijel/subscriptions","organizations_url":"https://api.github.com/users/nijel/orgs","repos_url":"https://api.github.com/users/nijel/repos","events_url":"https://api.github.com/users/nijel/events{/privacy}","received_events_url":"https://api.github.com/users/nijel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/phpmyadmin/phpmyadmin/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-03T09:43:51Z","updated_at":"2016-08-03T09:43:51Z","closed_at":null,"body":"Note: The below apply if I understood the policy correctly.\r\n \r\nAccording to    https://wiki.openstreetmap.org/wiki/Tile_usage_policy\r\n \r\nTechnical Usage Requirements:\r\n\r\n    \" If known, a valid HTTP Referer.\"\r\n \r\nPMA strip the Referrer header via CSP policy (To Avoid Referrer Leaks)\r\n \r\nfix:\r\n    while it's better from user/security perspective to not leak REFERRER at all, it appears that it might be against the rules?\r\n    it's possible to use referrerpolicy attribute to allow Referrer header to be sent for specific IMG tag by using referrerpolicy attribute:\r\n        https://developer.mozilla.org/en-US/docs/Web/HTML/Element/img#attr-referrerpolicy\r\n    # Note # using \"origin\" as value will leak only the origin without the path (better) and it's a \"valid HTTP Referer.\""}}
{"actor":{"display_login":"nijel"}}