508298 - Do not allow other websites to embed images hosted on sumo

Status: RESOLVED WONTFIX

(support.mozilla.org :: General, defect)

Description

[Chris Ilias [:cilias]]

In bug 449440 comment 5, there's an htaccess script to only allow embedding of images when the referrer is sumo. That script has still not been implemented.

(Will that script cause a problem on support-stage.mozilla.org?)

Comment 1

[Laura Thomson :laura]

Jeremy, can you please comment here?

Comment 2

[Jeremy Orem [:oremj]]

Yes, it looks like that htaccess change would cause problems on stage.

Comment 3

[Laura Thomson :laura]

Can we then modify this for stage as follows, so on stage we'll add
+
+  RewriteCond %{HTTP_REFERER} !^$
+  RewriteCond %{HTTP_REFERER} !^https?://support-stage.mozilla.org/.* [NC]
+  RewriteRule ^/.*/img/wiki_up/.* - [F]
+

and on prod as in the original:
+
+  RewriteCond %{HTTP_REFERER} !^$
+  RewriteCond %{HTTP_REFERER} !^https?://support.mozilla.com/.* [NC]
+  RewriteRule ^/.*/img/wiki_up/.* - [F]
+

Reassigning this to Jeremy - we can do it on stage any time, and should apply on prod during the 1.4 push window which is anticipated to be Thursday 24th September.

Comment 4

[Jeremy Orem [:oremj]]

Hmm, should we just commit this rule to htaccess:

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^https?://support(?:-stage)?.mozilla.org/.* [NC]
RewriteRule ^/.*/img/wiki_up/.* - [F]

Comment 5

[Jeremy Orem [:oremj]]

Ping comment 4.

Comment 6

[Laura Thomson :laura]

(In reply to comment #5)
> Ping comment 4.

Sorry I missed it.  Nicely done, please do.

Comment 7

[Jeremy Orem [:oremj]]

I'm not sure where this should be committed.

Comment 8

[James Socol [:jsocol, :james]]

Please reopen if this is still something we want to do, but if we have a goal to make more of our content accessible via APIs, then we're expecting other sites to use that content, including the images.

Comment 9

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.