Bug 21094

Summary: Syndetics: always use https instead of http
Product: Koha Reporter: Owen Leonard <oleonard>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: minor    
Priority: P5 - low CC: fridolin.somers, kyle, m.de.rooy, martin.renvoize, testopia, tomascohen
Version: Main   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:
Bug Depends on:    
Bug Blocks: 17137    
Attachments: Bug 21094: Syndetics: always use https instead of http
Bug 21094: Syndetics: always use https instead of http
Bug 21094: Syndetics: always use https instead of http

Description Owen Leonard 2018-07-19 16:43:33 UTC
As per bug 17137, we should be using SSL for all external resources.
Comment 1 Owen Leonard 2018-07-19 17:56:59 UTC
Created attachment 77140 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.
Comment 2 Kyle M Hall (khall) 2018-07-26 14:12:22 UTC
Created attachment 77292 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.

Signed-off-by: John Doe <you@example.com>
Comment 3 Katrin Fischer 2018-08-01 22:47:24 UTC
Created attachment 77416 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.

Signed-off-by: John Doe <you@example.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Tomás Cohen Arazi (tcohen) 2018-08-02 13:19:02 UTC
Pushed to master. Thanks!
Comment 5 Martin Renvoize (ashimema) 2018-08-03 14:20:04 UTC
Pushed to 18.05.x for 18.05.03. 

I've altered this from 'enhancement' to 'bug - minor'... it's a simple patch and improves security and user experience with zero detrimental effects.
Comment 6 Fridolin Somers 2018-09-21 09:56:06 UTC
Pushed to 17.11.x for 17.11.10
Comment 7 Marcel de Rooy 2020-08-05 14:02:14 UTC
Seems that this patch effectively eliminated the use of using_https while we still have it in C4/Auth..
See also bug 25360