Works for me.

I am able to reproduce the issue but have no time for further investigation at the moment.

Tried current master on Ubuntu 12.04 Server
Client Windows 8.1
IE11 works
FF30 does not work

I am going to disable the FF security headers as part of the modern UI pull request. Once we find a work around for this, we can enable it back or just as discussed here remove it since it is only on FF.

I don't think that disabling a security feature is a good idea.

It would be better to spend the time to find out why CSP is breaking the gravatars, and fix that properly instead.

I wonder if there is value in a security feature that is ON 20% of the time (i.e. when user is using Firefox). http://en.wikipedia.org/wiki/Usage_share_of_web_browsers

Any idea why loading avatars fails in case of the new UI, but the scenarios in the old UI where we loaded avatars didn't fail?

It seems that based on http://en.wikipedia.org/wiki/Content_Security_Policy there is a standard version of the header that is also supported by Chrome. If this is becoming a standard, then it makes sense for us to invest in keeping it.

Paul has a pull request to move to the standard header rather than the Chrome specific one.
https://github.com/mantisbt/mantisbt/pull/275

Any idea why loading avatars fails in case of the new UI, but the scenarios in the old UI where we loaded avatars didn't fail?

Not sure, I'd need to check... It's been a while since I last messed with CSP

Paul has a pull request to move to the standard header rather than the Chrome specific one.

I think this is what we should do indeed.

I'm still not able to reproduce this on my dev box - avatars display just fine on FF31

I am no longer able to reproduce it on FF31 and FF32 and current master
Might have been a bug in FF30.

+1 for replacing X-Content-Security-Policy by Content-Security-Policy

@grangeway, why category security ? Just because CSP is involved, does not make this a security issue IMO

Changing category to 'ui' and assigning to @syncguru to validated based on latest master code. If still an issue, provide steps to reproduce.

Also reduced severity since this shouldn't block at least beta version of 1.3.x.

This is still not working for me on either FF33 or Chrome. I am using Mac 10.9
Once I disable security headers, everything works just fine.

I also noticed that when security is enabled, Firebug - the popular FF plugin - does not work any more on any mantisbt page.

I am not able to reproduce it using FF36.
Maybe the issue is fixed in new FF version, maybe it's fixed as we replaced X-Content-Security-Policy by Content-Security-Policy.