Your message dated Mon, 13 Jun 2016 10:30:35 +0000
with message-id <[email protected]>
and subject line Bug#781449: fixed in wordpress 4.5.2+dfsg-2
has caused the Debian Bug report #781449,
regarding wordpress-theme-twentyfifteen: privacy leak due to accessing Google
servers for font/CSS download
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
781449: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781449
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wordpress-theme-twentyfifteen
Version: 4.1.1+dfsg-1
Severity: normal
Dear maintainer,
the themes references Google servers for downloading fonts or CSS:
/usr/share/wordpress/wp-content/themes> find -name "*php*" -or -name "*.js" |
xargs egrep -ir "googleapis"
./twentyfourteen/functions.php: $font_url = add_query_arg( $query_args,
'//fonts.googleapis.com/css' );
./twentyfifteen/functions.php: ), '//fonts.googleapis.com/css' );
I only got aware of it after I installed Iceweasel Request Policy addon.
I think this will give Google informations on the URLs the visitors
of the wordpress site visit. And was quite angry as I found this out
weeks after initially installing wordpress.
I installed
https://github.com/dimadin/disable-google-fonts
to protect the privacy of the visitors of my wordpress site.
According to Request Policy plugin this appears to work.
I know that patching the theme to avoid accessing Google servers is extra
maintenance work and may alter the appearence of the theme. For me wordpress
looks well enough that way, I didn´t notice any big difference.
An alternative idea would be to package that addon and add a clear hint
about it on installing wordpress package.
I am concerned about it, cause it introduces a privacy leak that someone who
installs wordpress can only notice by installing a privacy protection
plugin, or analysing the network traffic or source code.
I know lots of websites do it the same way meanwhile. But I really would
prefer when CSS and fonts are embedded into the package. I see no need to
push dialing to Google onto the client machines of the users who visit a
wordpress site.
In my eyes it is a silent leak of privacy, instead of having privacy as the
default. Here Debian packaging of wordpress can stand out by caring about
privacy.
I only report this for the most recent theme package, but the
twentyfourteen is also affected. I also think that the main wordpress
package may contain additional leaks, at least from the grep output I
got.
Thank you for your consideration,
Martin
-- System Information:
Debian Release: 7.8
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable'), (150, 'testing'), (100,
'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 3.16.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 4.5.2+dfsg-2
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 13 Jun 2016 12:29:11 +1000
Source: wordpress
Binary: wordpress wordpress-l10n wordpress-theme-twentysixteen
wordpress-theme-twentyfifteen wordpress-theme-twentyfourteen
Architecture: source all
Version: 4.5.2+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Description:
wordpress - weblog manager
wordpress-l10n - weblog manager - language files
wordpress-theme-twentyfifteen - weblog manager - twentytfifteen theme files
wordpress-theme-twentyfourteen - weblog manager - twentyfourteen theme files
wordpress-theme-twentysixteen - weblog manager - twentysixteen theme files
Closes: 772498 781449
Changes:
wordpress (4.5.2+dfsg-2) unstable; urgency=medium
.
* Updated language files Closes: #772498
* Add alias to nginx example configuration
* Add warning in description and README about googleapis
Closes: #781449
Checksums-Sha1:
e52eef6b2d3577e982b442ca34fe35d61d674af2 2521 wordpress_4.5.2+dfsg-2.dsc
bcdd2b599691cf288f2fdd97d9e4b6b54ebc7dbf 6133968
wordpress_4.5.2+dfsg-2.debian.tar.xz
552cb759753bf3f410e6733a6f51afa09245eb1c 4424788
wordpress-l10n_4.5.2+dfsg-2_all.deb
415eb15a3411895dab85f322c5f56c107603097c 699884
wordpress-theme-twentyfifteen_4.5.2+dfsg-2_all.deb
55ba7725f4bbc15222a3327a30bd47176d300249 1121322
wordpress-theme-twentyfourteen_4.5.2+dfsg-2_all.deb
622c89f44ded8d0d6f8a33ec078da3f8897c8d4f 588554
wordpress-theme-twentysixteen_4.5.2+dfsg-2_all.deb
d0f35fc8aa6e589c411b44f95f2bd9665a2c82f1 3717300 wordpress_4.5.2+dfsg-2_all.deb
Checksums-Sha256:
e708660b8b97df937ccdd81d58febf2698ce7bcd677cbe1bcaf92a05ec8b4a66 2521
wordpress_4.5.2+dfsg-2.dsc
a6d3e1ebc81f340f9e862540b38c488d4bdde0dd9378c94f6902716eeb5e45a2 6133968
wordpress_4.5.2+dfsg-2.debian.tar.xz
f2d8832f254fa02fb3e257fe3af3fb221b2ff4e18749710cee0bea74fb672c67 4424788
wordpress-l10n_4.5.2+dfsg-2_all.deb
bda588b84b8b147d674ef9feb38d4d7b45e417e681645f2c8508c02b8d6b55d9 699884
wordpress-theme-twentyfifteen_4.5.2+dfsg-2_all.deb
6c4795e13804393665817fb07470ab5fac9e615b4afd3c7c5ca213110836b754 1121322
wordpress-theme-twentyfourteen_4.5.2+dfsg-2_all.deb
107ba1eccb25d2b3e6da816738ca4c2ce1f796b363579ca57e356aa39ec3be84 588554
wordpress-theme-twentysixteen_4.5.2+dfsg-2_all.deb
39111009ab2e6f1e460032dc994bc654fc9fdd42e074bf8f5a5b725c62cdd948 3717300
wordpress_4.5.2+dfsg-2_all.deb
Files:
5e7a632ac64d84ec4fa33abba78525ed 2521 web optional wordpress_4.5.2+dfsg-2.dsc
223f86464735dbc235efffd9c2024967 6133968 web optional
wordpress_4.5.2+dfsg-2.debian.tar.xz
6b62eed501a06ca8a105913be7adfb0f 4424788 localization optional
wordpress-l10n_4.5.2+dfsg-2_all.deb
ffcd41729b1bc7ee3cd898b90f1a1507 699884 web optional
wordpress-theme-twentyfifteen_4.5.2+dfsg-2_all.deb
b50c7329c15948374cfb56ed5412119c 1121322 web optional
wordpress-theme-twentyfourteen_4.5.2+dfsg-2_all.deb
0c4a81ccf8ad44d8ffdb12ac2020a396 588554 web optional
wordpress-theme-twentysixteen_4.5.2+dfsg-2_all.deb
8e0a384579963d8f39d69af712a803bb 3717300 web optional
wordpress_4.5.2+dfsg-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJXXmLKAAoJEAIhZsD/PITjL1oQAJ5z0tKE1Bbp42cfvne22h/j
5t0eLq+ejbWqLcu0TAy3xzJokKYKS0f0RX4Etou8IaiVi6FiA0jsRBI392dKk1Cz
J8X534/jh4gLu33QPEi/W6pCqsL+RPlfwpoNmmi3GKHpeqEXew0DKIJGEV+d5ccX
T2VCiU/B+dSyjbMqCyMhs6DGGIFaQA/yK5+xIMETI5xjrDPP+aksVCRHEcnabBbw
fQqEHvXzvTyUgTcpSmZobVu0FF7x0DKgEGhI7EHlVzI1bVjwXsGFYZ5dH1aB4PVy
3ccKOkLO9NUGUhWkKLQXbIo2B7jpHL/01lIunyv0FGAmWa7ABnBTS52g9t5HlZfV
8P5YB6xD/4wLrZc8RF124boPsbM9imWjUvW50BABDItN+JPtPfER2g574dWL9tad
AQtdtuw3oD3P7AGAi5v0BJMTxRdbs5FZmeUd74mXo8IA4L2fudC2j/gzGD6Ekzhj
WYTlnzjQCCNKuiWewBd+bLYDFKghfADcgt20CPw2ev+RMvczvRwK+2nozBGvyjU7
wY4reWfz08tPz2t8UA50YDMTIRD6oRBe0FUP5wTMbtZAhHDpkw65sYyLbgC9cnb+
T5mUwitszApKut2tU9qDW6TO5RSUSPUmLmZVU4UVIJ6H2FwBejSzdUOt4qaUVz3g
RSArPA4Qcfx9Fl5bH42q
=XT/5
-----END PGP SIGNATURE-----
--- End Message ---
