Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-17059

Emojis should not be loaded from external source if CDN is disable

    XMLWordPrintable

Details

    • Improvement
    • Status: Patch Awaiting Review (View Workflow)
    • Minor
    • Resolution: Unresolved
    • 3.3.9-RC1
    • None
    • BBCode Engine, Posting
    • None

    Description

      At the moment emojis get loaded from an external source, without any reference to the setting "$config['allow_cdn']". This is against the ACP setting and a problem for privacy policy, because a 3rd parties connection will be created without user notice or approval.

      See:

      phpBB\phpbb\textformatter\s9e\factory.php:

      $tag->template = '<xsl:choose>
      			<xsl:when test="@tseq">
      				<img alt="{.}" class="emoji" draggable="false" src="//twemoji.maxcdn.com/2/svg/{@tseq}.svg"/>
      			</xsl:when>
      			<xsl:otherwise>
      				<img alt="{.}" class="emoji" draggable="false" src="https://cdn.jsdelivr.net/gh/s9e/emoji-assets-twemoji@11.2/dist/svgz/{@seq}.svgz"/>
      			</xsl:otherwise>
      		</xsl:choose>';
      

      There should be a selfhosted version with the emojis in the latest version in the assests/-directory of phpBB. With CDN enabled, it can stay as it is.

      Attachments

        Activity

          People

            Unassigned Unassigned
            Crizzo Crizzo
            Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: