- Affected version
- 2.0 Beta 1
Steps to reproduce
The image is being shown
Actual Result
The image is not being shown as the HTML in the editor contains the orginal image URL and not the proxy url and thus is blocked.
A website without Content-Security-Policy: block-all-mixed-content (like xenforo.com) loses the padlock as soon as the editor has been loaded.
- Configure a HTTPS server with header Content-Security-Policy: block-all-mixed-content
- Enable Image Proxy
- Create a post with a image hosted on a non-secure server
- Verify that it is being displayed and that the site is sill secure
- Edit the post
The image is being shown
Actual Result
The image is not being shown as the HTML in the editor contains the orginal image URL and not the proxy url and thus is blocked.
A website without Content-Security-Policy: block-all-mixed-content (like xenforo.com) loses the padlock as soon as the editor has been loaded.