From 93ff3c773f71463ce04b2bff60c696cebe951498 Mon Sep 17 00:00:00 2001
From: liangxu <liangxu0920@qq.com>
Date: Mon, 27 Apr 2026 01:00:04 +0800
Subject: [PATCH] fix(admin-web): set no-referrer policy on cross-origin
 platform avatars

Platforms like Bilibili refuse to serve avatar images when the
Referer points at our admin origin, so the article publish status
panel and the media account cards now request avatars with a
no-referrer policy to stop the placeholder from showing instead of
the user's real avatar.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 apps/admin-web/src/components/ArticlePublishStatus.vue | 1 +
 apps/admin-web/src/views/MediaView.vue                 | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/admin-web/src/components/ArticlePublishStatus.vue b/apps/admin-web/src/components/ArticlePublishStatus.vue
index 377c102..af8709b 100644
--- a/apps/admin-web/src/components/ArticlePublishStatus.vue
+++ b/apps/admin-web/src/components/ArticlePublishStatus.vue
@@ -267,6 +267,7 @@ function getAccountInitial(accountName: string): string {
                         :src="entry.avatarUrl"
                         :alt="entry.accountName"
                         class="article-publish-status__account-avatar-img"
+                        referrerpolicy="no-referrer"
                       />
                       <template v-else-if="getAccountInitial(entry.accountName)">
                         {{ getAccountInitial(entry.accountName) }}
diff --git a/apps/admin-web/src/views/MediaView.vue b/apps/admin-web/src/views/MediaView.vue
index bbc8102..c99b389 100644
--- a/apps/admin-web/src/views/MediaView.vue
+++ b/apps/admin-web/src/views/MediaView.vue
@@ -362,7 +362,7 @@ async function refreshAll(): Promise<void> {
             <div class="media-card__head">
               <div class="media-card__identity">
                 <span class="media-card__avatar" :style="{ background: account.platformAccent }">
-                  <img v-if="account.avatarUrl" :src="account.avatarUrl" :alt="account.displayName" />
+                  <img v-if="account.avatarUrl" :src="account.avatarUrl" :alt="account.displayName" referrerpolicy="no-referrer" />
                   <span v-else>{{ accountInitial(account) }}</span>
                 </span>