lichess-org / lila

♞ lichess.org: the forever free, adless and open source chess server ♞
https://lichess.org
GNU Affero General Public License v3.0
15.57k stars 2.28k forks source link

External link warning should be on bio like on social media links #15814

Closed danispringer closed 1 month ago

danispringer commented 3 months ago

Exact URL of where the bug happened

Any profile with a link in their bio and a social media link listed

Steps to reproduce the bug

When clicking on a social media link from the list of links on a profile, a warning pops up, but when clicking on a link (even the same link) from the bio of a profile, no warning is shown.

Operating system

macOS/iOS

Browser and version (or alternate access method)

Safari/Brave

IMG_3719

IMG_3720

DreamRunnerMoshi commented 3 months ago

These are the urls, Lila will not ask for confirmation. If you have add links other than these, for your case, ideally this pop up should show up.

lichess.org lichess4545.com ligacatur.com
github.com discord.com discord.gg mastodon.online
twitter.com facebook.com twitch.tv
wikipedia.org wikimedia.org
chess24.com chess.com chessable.com
danispringer commented 3 months ago

@DreamRunnerMoshi it definitely should show popup because it shows it when clicking on the same exact link from links list, but not from bio. It seems not to matter what link is in bio. It won't show regardless.

DreamRunnerMoshi commented 3 months ago

Oh, understood but it still show in bio too, right ?

danispringer commented 3 months ago

@DreamRunnerMoshi https://lichess.org/@/puzzles_avocado if you click on bitly link lower down, it warns, it higher up, it doesn't. Please see above screenshots for reference, and you can also try clicking on the 2 links on my profile to test this. Thanks.

BElluu commented 3 months ago

I think we should display warning for every domain which is not on "white list", so for now all exclude lichess and patronite :D

DreamRunnerMoshi commented 3 months ago

@BElluu You might be right but that is another issue. But this is a bug and it is vulnerable to phishing.