[phpldapadmin] [ phpldapadmin-Bugs-2997703 ] SourceForge logo should load from HTTPS when using HTTPS

Bugs item #2997703, was opened at 2010-05-06 10:43
Message generated for change (Comment added) made by ziesemer
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997703&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.2.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Mark Ziesemer (ziesemer)
Assigned to: Nobody/Anonymous (nobody)
Summary: SourceForge logo should load from HTTPS when using HTTPS

Initial Comment:
When hosting PLA over HTTPS, all page resources are also properly loaded over HTTPS _except_ the SourceForge logo in the page footer.  It continues to load from http://sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8 , and causes security warnings in the browser due to "partial encryption".

Really, the pages should not be loading any resources from any external domains, which could cause issues in restricted environments.  Preferably, copy the image (if allowed) into the distribution, and load it just like any of the other images.  Otherwise, the logo should probably just be removed entirely.

Using phpLDAPadmin 1.2.0.5, OpenLDAP 2.4.21, Apache 2.2.14, PHP 5.3.2, and Ubuntu Linux 10.04.

----------------------------------------------------------------------

>Comment By: Mark Ziesemer (ziesemer)
Date: 2010-05-06 11:12

Message:
Found a potential solution in
https://sourceforge.net/mailarchive/message.php?msg_name=E9E9BAC7D3459C40BAA714735552E0E4512420EE82%40SDCSRVEX01.sdc-world.com
.  Found the "remoteurls" option also mentioned at
http://phpldapadmin.sourceforge.net/wiki/index.php/Config.php , but is
otherwise undocumented.

In terms of this bug, at a minimum, changing line #2540 in
lib/functions.php from
"http://sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8" to
"//sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8" will cause the
logo to be loaded over the same protocol as the page, eliminating the
security warnings - whether or not the "remoteurls" option is configured.

I would still encourage having it copied into the distribution, if
allowed, or disabled by default.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997703&group_id=61828

------------------------------------------------------------------------------
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/