[phpldapadmin] [ phpldapadmin-Bugs-2997703 ] SourceForge logo should load from HTTPS when using HTTPS

Bugs item #2997703, was opened at 2010-05-07 01:43
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997703&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.2.x
>Status: Closed
>Resolution: Fixed
Priority: 5
Private: No
Submitted By: Mark Ziesemer (ziesemer)
Assigned to: Nobody/Anonymous (nobody)
Summary: SourceForge logo should load from HTTPS when using HTTPS

Initial Comment:
When hosting PLA over HTTPS, all page resources are also properly loaded over HTTPS _except_ the SourceForge logo in the page footer.  It continues to load from http://sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8 , and causes security warnings in the browser due to "partial encryption".

Really, the pages should not be loading any resources from any external domains, which could cause issues in restricted environments.  Preferably, copy the image (if allowed) into the distribution, and load it just like any of the other images.  Otherwise, the logo should probably just be removed entirely.

Using phpLDAPadmin 1.2.0.5, OpenLDAP 2.4.21, Apache 2.2.14, PHP 5.3.2, and Ubuntu Linux 10.04.

----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2010-11-16 20:28

Message:
Remote URL's can already be disabled with a config directive
(appearance,remote_urls).

Fixed, https will be used if PLA is used in a HTTPS environment. Git
commit #f9c56bc

----------------------------------------------------------------------

Comment By: Mark Ziesemer (ziesemer)
Date: 2010-05-07 02:12

Message:
Found a potential solution in
https://sourceforge.net/mailarchive/message.php?msg_name=E9E9BAC7D3459C40BAA714735552E0E4512420EE82%40SDCSRVEX01.sdc-world.com
.  Found the "remoteurls" option also mentioned at
http://phpldapadmin.sourceforge.net/wiki/index.php/Config.php , but is
otherwise undocumented.

In terms of this bug, at a minimum, changing line #2540 in
lib/functions.php from
"http://sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8" to
"//sflogo.sourceforge.net/sflogo.php?group_id=61828&type=8" will cause the
logo to be loaded over the same protocol as the page, eliminating the
security warnings - whether or not the "remoteurls" option is configured.

I would still encourage having it copied into the distribution, if
allowed, or disabled by default.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=2997703&group_id=61828

------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
Spend less time writing and  rewriting code and more time creating great
experiences on the web. Be a part of the beta today
http://p.sf.net/sfu/msIE9-sfdev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/