mirror of
https://github.com/ArchiveBox/ArchiveBox.git
synced 2026-04-26 01:26:00 +03:00
[GH-ISSUE #598] Bugfix: Disable third party requests (stop leaking private URLs to archive.org) #3390
Labels
No labels
expected: maybe someday
expected: next release
expected: release after next
expected: unlikely unless contributed
good first ticket
help wanted
pull-request
scope: all users
scope: windows users
size: easy
size: hard
size: medium
size: medium
status: backlog
status: blocked
status: done
status: idea-phase
status: needs followup
status: wip
status: wontfix
touches: API/CLI/Spec
touches: configuration
touches: data/schema/architecture
touches: dependencies/packaging
touches: docs
touches: js
touches: views/replayers/html/css
why: correctness
why: functionality
why: performance
why: security
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/ArchiveBox#3390
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Jan 3, 2021).
Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/598
Describe the bug
After setting SAVE_ARCHIVE_DOT_ORG to "False" as described in the README archive.org still gets contacted. Therefore ArchiveBox leaks private URLs to archive.org
I would suggest to either disable archive.org in the webfrontend completely if SAVE_ARCHIVE_DOT_ORG is disabled or to introduce another option which disables current and new third party requests altogether.
Steps to reproduce
Screenshots or log output
You can clearly see requests to archive.org in your browsers network tab.
Software versions
archivebox/archivebox latest 3f9e2703d63d 4 weeks ago 1.14GB@pirate commented on GitHub (Jan 4, 2021):
What page did you open in the ArchiveBox UI that fired these requests?
@ghost commented on GitHub (Jan 4, 2021):
This one https://archivebox.zervice.io/archive/1602401954.435773/index.html (of course locally on my own archivbox)
@pirate commented on GitHub (Feb 1, 2021):
This is fixed and out in the new
v0.5.4release. It will now hide the Archive.org iframe / preview on the Snapshot detail page if it was archived whileSAVE_ARCHIVE_DOR_ORG=Falsewas set.