This may also be related to 0012824 and/or 0010850.

It may be worth noting that WordPress, which also uses Gravatars, generates the Gravatar URL slightly differently.

For example, the URL generated here on Mantis for my Gravatar (stripping out the size & rating parameters for simplicity) is:

http://www.gravatar.com/avatar.php?gravatar_id=51c993a6256194924615053475a14238

The same Gravatar URL generated by WordPress (again, without the size or rating parameters for simplicity's sake) is:

http://1.gravatar.com/avatar/51c993a6256194924615053475a14238

I'm not sure if this makes any difference whatsoever, though. (A quick test on my own hosted MantisBT installation seems to show that it does not, but this is quickly getting over my head.)

Thanks for the bug report. I'll fix this in a few hours time. We just need to add http://www.gravatar.com to the list of CSP exceptions for the img-src directive. I think this occurs within core/http_api.php if you're looking to quickly fix it yourself.

After reviewing the latest code I'm not seeing why this bug would occur.

When MantisBT is loaded within a HTTPS environment, Gravatar URLs will direct to secure.gravatar.com:443 instead of www.gravatar.com:80. The Content-Security-Policy setting will do the same thing.

Are you able to try the latest nightly build of 1.2.x and are you able to let me know whether this issue can be repeated for HTTP and/or HTTPS?

Tested with nightly build mantisbt-1.2.4-2011-03-25-master-1.2.x-f190021; confirmed issue is reproducible over both HTTP and HTTPS.

The HTTP warning is:

Warning: CSP: Directive "img-src http://www.[my-site-redacted].com https://secure.gravatar.com:443" violated by http://www.gravatar.com/avatar.php?gravatar_id=9e9be8c7b05f82d1461c791e93ba93e5&default=identicon&size=80&rating=G

The HTTPS warning is:

Warning: CSP: Directive "img-src https://www.[my-site-redacted].com http://www.gravatar.com:80" violated by https://secure.gravatar.com/avatar.php?gravatar_id=9e9be8c7b05f82d1461c791e93ba93e5&default=identicon&size=80&rating=G

Oh my - I think I just realized what the problem is when I saw what I just wrote.

It looks like the function http_security_headers() in core/http_api.php has things backwards!

The original code is:

if ( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) {
$t_avatar_img_allow = "; img-src 'self' http://www.gravatar.com:80";
} else {
$t_avatar_img_allow = "; img-src 'self' https://secure.gravatar.com:443";
}

But it should be:

if ( isset( $_SERVER['HTTPS'] ) && ( utf8_strtolower( $_SERVER['HTTPS'] ) != 'off' ) ) {
$t_avatar_img_allow = "; img-src 'self' https://secure.gravatar.com:443";
} else {
$t_avatar_img_allow = "; img-src 'self' http://www.gravatar.com:80";
}

I've made this modification to my install and can confirm that it does indeed work.

Keith, thanks for debugging the issue and providing the solution. I have committed your change to both branches of MantisBT.