Convert any remaining mixed content (http/https) to prepare for Chrome change

[jywarren]

Chrome will soon start blocking any http content loaded from an https page - not just scripts and iframes, but images, etc.

https://www.bleepingcomputer.com/news/google/google-chrome-to-gradually-start-blocking-mixed-content-by-default/

We did this for iframes and scripts a while back but we should plan to scan for any http:// in our codebase and fix it! It could make for good first timer issues, too. The standard GitHub search is not bad for finding things like this, so please paste in code links in the comments as you find them.

Then, we'll have to develop a script to do this for all site database content as well. That'll be harder.

Any help appreciated!

[deboragaleano]

Could I claim this issue? Thanks!

[deboragaleano]

Hi @jywarren. I just did a standard GitHub search and it gives me 78 code results, see below:

Here are some examples of code links that I found (there are more, of course!):

https://github.com/publiclab/plots2/blob/7c9d0637170ec8d39be8f773c6761a225ce7cf87/static/index.html

https://github.com/publiclab/plots2/blob/5c0d96274bd0be15feba69d8f30093082402ace5/public/422.html

https://github.com/publiclab/plots2/blob/5c0d96274bd0be15feba69d8f30093082402ace5/public/404.html

However, I'm not so sure how to go about converting or developing a script to fix all these links.

[nstjean]

@deboragaleano Can you do a replace -> replace all in your text editor program? I know VSCode has that option.

[deboragaleano]

Hi @nstjean, yes sure, thanks for your message. I use VSCode so I'll try to a replace :)

[IvetaHron]

Hi @deboragaleano, do you need any help with this issue?

[deboragaleano]

Hi @IvetaHron, I've been having issues with my computer so this may take a while. If you want to go ahead, please do ;)
Thanks!

[IvetaHron]

Hi @deboragaleano, thank you. I will start to work on it tomorrow. I will keep you posted.

[SidharthBansal]

Thanks for your PR.
I will review it in a minute

[SidharthBansal]

I think we are still left with some http.
@IvetaHron can you please help in creating the FTOs instead of opening PRs for Google Code In.
Thanks

[jywarren]

This is all really good work. Noting that for some uses you can use "// publiclab.org/..." and omit "http:" or "https:" and it will default to the one that's being used on the page you're on. Also, let's continue to do this in relatively small pieces rather than a huge find/replace of the whole codebase - that way we can diagnose when/if things go wrong piece by piece. Thanks to everyone! Great work!!!!

…

On Thu, Oct 31, 2019 at 10:57 AM Sidharth Bansal ***@***.***> wrote: I think we are still left with some http. @IvetaHron <https://github.com/IvetaHron> can you please help in creating the FTOs instead of opening PRs for Google Code In. Thanks — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6391?email_source=notifications&email_token=AAAF6J5E2V46GTXVTZXZYKTQRLW2NA5CNFSM4I5PQLG2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECYCR5Q#issuecomment-548415734>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6J7SH5544JGVWTGZE3TQRLW2NANCNFSM4I5PQLGQ> .

[IvetaHron]

Hi @SidharthBansal, @jywarren thank you for reviewing my PRs. I have created new FTO issue - #6834 for GCI, but I could not add the GCI label to it. I will continue creating more new issues in coming days.

[SidharthBansal]

Sorry for delayed reply. You can surely create new ftos. Thanks for your support.

…

On Fri, Nov 22, 2019 at 3:23 AM IvetaHron ***@***.***> wrote: Hi @SidharthBansal <https://github.com/SidharthBansal>, @jywarren <https://github.com/jywarren> thank you for reviewing my PRs. I have created new FTO issue - #6834 <#6834> for GCI, but I could not add the GCI label to it. I will continue creating more new issues in coming days. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#6391?email_source=notifications&email_token=AFAAEQ42JW45JQURST2NUGTQU37L5A5CNFSM4I5PQLG2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEE3Y43Q#issuecomment-557289070>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFAAEQ4D6HVYLCPUG5EZIATQU37L5ANCNFSM4I5PQLGQ> .

[Karska-dev]

Hi! Can I work with this?

[noi5e]

Hi, I just wanted to give a heads-up and say that I'm going to make some FTO issues out of this one...

There are still a few places in the codebase with http links. Some of them seem to be irrelevant to this issue. (Like, one of them seems to be a footer in an automated email from the server, and there are a few that are simply Ruby and JS commented code snippets.)

However there are a few I'm thinking would be good to update to https.

I was thinking I would make a single issue listing out multiple places in the app, so multiple first-timers can link and pull to just a single issue. (In the style of something like issue 8545). Should be done by end of day.

(Outreachy applicant here, and pretty new to Public Lab's codebase, so open to pointers!)

[jywarren]

Just noting this is a great idea, and plenty of places to do this! For some cases, you can use // instead of https:// and it will just default to whatever the current page is using. But that won't work in, for example, an email template.

Anyways, this is awesome, thanks!!!

[ebarry]

Thanks @noi5e ! Looks like your new issue got a lot of uptake with 5+ contributors writing code towards it, thank you for unblocking these contributions!
Once that issue is closed, let's be sure to come back here and close this one too :)

[jywarren]

I just went through https://github.com/publiclab/plots2/search?q=http:// and didn't find any that look like an issue! Closing this! 🎉