Yes, all access to outside sources is blocked by default and users are asked on a per URL basis with the author manually requesting each URL access including a reason – with occasional manual validation from Mozilla staff.