Page MenuHomePhabricator

Default avatar links to a non-secure domain, causing a mixed content warning on secure sites
Open, LowestPublic

Description

It would be nice if the default avatar was just an internal image.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
ashley triaged this task as Lowest priority.Jul 27 2019, 10:53 AM
ashley subscribed.

This is somewhat of an edge case that happens only when Comments is installed without SocialProfile. That is a supported scenario in that having Comments fatal simply over that seemed outright nasty to me, so I opted to introduce a very simple fallback -- the default SocialProfile avatar image hotlinked from an external source, as I didn't want to duplicate the said image in Comments' repo as well. That's basically why it's configurable; to work around this, you can set $wgCommentsDefaultAvatar = 'https://cdn.jsdelivr.net/gh/wikimedia/mediawiki-extensions-SocialProfile@master/avatars/default_ml.gif';, for example, to serve the image securely from the GitHub repository via jsDelivr CDN.

That being said, having Comments installed without SocialProfile seems silly to me, given how in such a scenario users are unable to customize their avatar, as SocialProfile's wAvatar class is the only avatar backend that Comments knows about currently. Bundling avatar backend stuff that already exists in SocialProfile seemed counterproductive to me and I felt like if someone wants avatars, they should just install SocialProfile as that's the extension which provides that functionality; hence the config global. If you wish to add support for other avatar backends (e.g. a custom PHP class, like whatever class the BlueSpiceAvatars MW extension provides, or Gravatar, etc.), please feel free to; as long as we're not literally reimplementing SocialProfile in Comments, that seems reasonable.