CUNY Academic Commons

This happened because someone embedded an image into a blog post, and the image required HTTP authentication, and the post was syndicated to the activity stream on the front end. It's now disappeared from the scroll on the front page, so it's not an immediate issue.

I'm not sure how to protect against this in the future. Some ideas - Ray, let me know if you have more.

1. Strip images in front-page activity stream based on a domain blacklist. Advantages: Unlikely to have side effects. Disadvantages: Images may be unavailable based on things other than domain (HTTP auth for specific URLs, 404s, access control other than HTTP auth)
2. Strip all images in front-page activity stream. Advantages: Eliminates the problem. Disadvantages: Way too broad, makes the content on the home page less engaging.
3. Strip images in front-page activity stream if they're pulled from a domain other than the URL of the source site. Advantages: Strikes a balance between the breadth of the two strategies above. Disadvantages: Still susceptible to 404s; potentially strips valuable content from legitimate third-party sources.

I'd go with option 1, the blacklist option.

There are not many people that would link to HTTP-auth resources, so in this case we would just remove images from the activity stream matching the bbhosted.cuny.edu domain.

I guess a more, broad approach would be to check image links before saving them into the wp_bp_activity database table. Downsides are the usage of wp_remote_head() and checking a post with a ton of images.

Thanks, Ray!