Mixed content blocked

[Kristina Hoeppner]

Browers blocking mixed content, esp. when you are on a SSL enabled site is becoming more of an issue esp. since not all browsers make this blocking obvious. Firefox only has a small icon in the universal bar.

We already fixed bug #1207140 but that doesn't apply to other places where mixed content is used, e.g. in external image galleries. Flickr for example typically shows you http, but you can use the same URL under https. Thus, if you know that, you can use that instead on your SSL site.

Is there a way of implementing something like the protocol relevant URL in Mahara or make it more obvious that content can't be displayed due to it being mixed? With more and more people having SSL, this will become more of a question.

For an example, see https://mahara.org/interaction/forum/topic.php?id=5712

[Aaron Wells (u-aaronw)]

Well, we could be more aggressive about searching user-uploaded content, finding scheme-specific URLs, and converting them to scheme-relative URLs.

The only problem with that solution is that if the server in question only supports one scheme, then turning it into a scheme-relative URL would cause it to break.

Some likely places we'd need to do this:

 - external content block
 - displaying the output of an external feed block (i.e. translate the URLs in the RSS)
 - any text field where we let the user enter <img> tags. ALTHOUGH TinyMCE seems to automatically handle some of this on the JS side, converting all the links in the text so that they match the protocol of the currently-loaded page.

[Darren James Harkness (darren-athabascau)]

Recently had a student report an issue related to this, where http:// content (image) was added to a note block on a site running in https://

This prevented the student from editing the page the Note block was included in. Instead of displaying the blocks on the page, only a spinner was displayed.

[Darren James Harkness (darren-athabascau)]

Something to note (re: scenario in #2) is that it does not trip the browser's option to allow insecure content. For example, in Firefox, mixed mode can be enabled by clicking on the Shield icon and allowing the insecure content (see https://support.mozilla.org/en-US/kb/how-does-content-isnt-secure-affect-my-safety). On the portfolio edit page, this icon is never made available in Firefox.

[Aaron Wells (u-aaronw)]

Hi Darren,

I wasn't able to replicate the specific problem you described. What version of Mahara are you using?

Here are the steps I took to replicate:

1. Create a new page on https://mahara.org (which is currently running Mahara 1.9.3)

2. Add a "Text box" block to the page.

3. In TinyMCE, add this image by URL: http://www.iowaline.net/bigvolcano.gif

4. Save the block.

5. View the page.

6. Click the "Edit" button for the page

7. Click the "Edit" button for the text block

Everything worked as expected, not even any browser warnings. (Although perhaps I disabled my browser warnings about mixed content at some point in the past?)

[Darren James Harkness (darren-athabascau)]

Hi Aaron,

Apologies - didn't see your reply until now.

This is on Mahara 1.10.1.

Oddly, when I went back to reproduce the issue just now, I wasn't able to.

So, feel free to close this bug for now. If it reappears, I'll reopen with steps to reproduce.

[Kristina Hoeppner (kris-hoeppner)]

Hi Darren,

Thanks for giving it another go. Yes, if you run into the problem again, please provide your testing instructions.

Cheers
Kristina