Bug 10944 - Mixed content warnings in results and detail with Amazon images on https
Summary: Mixed content warnings in results and detail with Amazon images on https
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: 3.14
Hardware: All All
: P5 - low minor (vote)
Target Milestone: ---
Assignee: Robin Sheat
QA Contact: Testopia
URL:
Whiteboard:
Keywords: rel_3_16_candidate
Depends on:
Blocks: 11358
  Show dependency treegraph
 
Reported: 2013-09-25 02:49 UTC by Liz Rea
Modified: 2015-01-14 08:17 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this: 2013-09-29 00:00:00
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 10944 - Mixed content warnings in opac results and detail with Amazon images on https (6.04 KB, patch)
2013-09-25 03:02 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 10944 - Mixed content warnings for covers on staff client (7.28 KB, patch)
2013-10-06 22:00 UTC, Robin Sheat
Details | Diff | Splinter Review
Bug 10944 - Mixed content warnings for covers on staff client (7.27 KB, patch)
2013-10-09 02:03 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 10944 - Mixed content warnings in opac results and detail with Amazon images on https (6.09 KB, patch)
2013-10-25 14:04 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 10944 - Mixed content warnings for covers on staff client (7.37 KB, patch)
2013-10-25 14:04 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 10944 - Followup for Bootstrap Amazon images on https OPAC (3.85 KB, patch)
2013-12-03 20:54 UTC, Liz Rea
Details | Diff | Splinter Review
[PASSED QA] Bug 10944 - Mixed content warnings in opac results and detail with Amazon images on https (6.17 KB, patch)
2013-12-04 09:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 10944 - Mixed content warnings for covers on staff client (7.45 KB, patch)
2013-12-04 09:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 10944 - Followup for Bootstrap Amazon images on https OPAC (3.94 KB, patch)
2013-12-04 09:44 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 10944 - Followup for Bootstrap Amazon images on https OPAC (3.94 KB, patch)
2013-12-04 09:50 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 10944 - opac-user and opac-readingrecord had instances of non-https amazon images (4.57 KB, patch)
2014-01-23 02:12 UTC, Liz Rea
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2013-09-25 02:49:39 UTC
It's probably going to become more popular to run Koha in SSL environments - currently on ssl, with Amazon images enabled, a SSL enabled site will either not show Amazon images (IE, some versions of Firefox?), or show a warning to users about mixed secure and insecure content (Firefox, Chrome).

Since we now have the using_https template variable, it makes sense to use it.
Comment 1 Liz Rea 2013-09-25 03:02:02 UTC Comment hidden (obsolete)
Comment 2 I'm just a bot 2013-09-29 06:15:55 UTC
Patch applied cleanly, go forth and signoff
Comment 3 Robin Sheat 2013-10-06 22:00:19 UTC Comment hidden (obsolete)
Comment 4 Liz Rea 2013-10-09 02:03:59 UTC Comment hidden (obsolete)
Comment 5 Robin Sheat 2013-10-20 21:38:46 UTC
Ed, you've marked this as signed off but haven't attached a signed off version of the patch, was that intentional?
Comment 6 Katrin Fischer 2013-10-20 21:52:54 UTC
I think it looks like bug number confusion.
Comment 7 Kyle M Hall 2013-10-25 14:04:12 UTC Comment hidden (obsolete)
Comment 8 Kyle M Hall 2013-10-25 14:04:34 UTC Comment hidden (obsolete)
Comment 9 Katrin Fischer 2013-12-02 23:28:09 UTC
I have followed the instructions and set up https, but I am confused by the results:

OPAC
Still running on localhost:8080, but the Amazon cover URL appears as https:// on the results page and on the details page.

Intranet
Now working with localhost and 442, but the Amazon cover URL is still http:// on the results and the details page.

Liz, can you please check?
Comment 10 Martin Renvoize 2013-12-03 12:53:50 UTC
I think I've got to the bottom of why I couldn't get this to work.. It's not implemented in the bootstrap theme. Could someone do a follow-up with bootstrap support please?
Comment 11 Liz Rea 2013-12-03 20:54:23 UTC Comment hidden (obsolete)
Comment 12 Liz Rea 2013-12-03 21:38:03 UTC
Hi Cait,

I wasn't able to replicate your issue - the image url changed correctly for me based on whether or not the site was running in SSL in the OPAC. You would need both patches to cover both OPAC and intranet. 

The intranet patch doesn't even have a non-ssl mode for fetching the images - you will always get the ssl version of the image no matter the mode. The thinking is - we should not ever be running (yes, of course we *do* but we *shouldn't*!) the intranet in non-SSL. It doesn't hurt anything to fetch the https image over the http version, so Robin simply made that choice to do it without the ability to switch.
Comment 13 Martin Renvoize 2013-12-04 09:22:31 UTC
Hi Liz, 

That's all looking pretty good to me now, though there is one minor discrepancy that's crept in on the bootstrap theme. in http the class=item-thumbnail whereas in https class=thunmbnail which make the image display slightly differently depending upon http or https. Though it's no biggy (I actually prefer the styling on the https version myself with a minor border).

I'm currently testing to see if it affects the results turned up for .com vs other local amazon's, and testing that the other amazon preferences aren't affected.

I think cait's issues were to do with her ssl setup so she's asked me to do qa.
Comment 14 Martin Renvoize 2013-12-04 09:44:19 UTC
Created attachment 23282 [details] [review]
[PASSED QA] Bug 10944 - Mixed content warnings in opac results and detail with Amazon images on https

It's probably going to become more popular to run Koha in SSL environments.
Currently on ssl, with Amazon images enabled, a SSL enabled site will either not show Amazon images (IE, some versions of Firefox?), or show a warning to users about mixed secure and insecure content (Firefox, Chrome).

Since we now have the using_https template variable, it makes sense to use it.

To test:

In each browser you have access to, and preferably with SSL set up
(you can set up a self signed cert for your dev install by following, more or less, the instructions here: https://wiki.debian.org/Self-Signed_Certificate)

For the apache config, just copy the one for the OPAC, but set it to use 443 instead of 80 for the port, and point it to your keys per the instructions above.

** note that using a self signed cert on your dev install will prompt you when you connect the first time
that OMG I CAN'T VERIFY THIS IS COOL. You did it yourself, if you can't trust yourself... then who can you trust?

* Enable Amazon images in the system preferences
* Do a search that you know will have images for, verify that without SSL
1. the images show
2. the image source is from an Amazon url that uses http://
3. the images are the right size, and look ok
* Do the same using https, verify that with SSL
1. the images show
2. the image source is from an Amazon url that uses https://
3. the images are the right size, and look ok

Clicking on the image should link to the item on Amazon. This patch also corrects a problem with the Amazon url used on the images -
it was pointing to a feature that is currently unavailable. That's fixed here.
All you need to check is that it goes to a valid Amazon endpoint that doesn't show an error.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 15 Martin Renvoize 2013-12-04 09:44:29 UTC
Created attachment 23283 [details] [review]
[PASSED QA] Bug 10944 - Mixed content warnings for covers on staff client

This switches the URLs used to access Amazon's cover images to the SSL image
server, preventing warnings when using this on a secure site.

To test:
* Enable Amazon images in the sysprefs, all other cover images off.
* Do a search in the staff client. Using firebug or similar, inspect the
  images that indicate both "no image found" and the covers.
* Are they all https, and showing correctly?

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 16 Martin Renvoize 2013-12-04 09:44:38 UTC Comment hidden (obsolete)
Comment 17 Martin Renvoize 2013-12-04 09:47:31 UTC
I'm happy that this all works as advertised and doesn't introduce any regressions anywhere.

It passes the QA script and even tidies up the templates a little.  I corrected the minor discrepancy in class upon thumbnails in opac-results for bootstrap as it was a very minor change to make.
Comment 18 Martin Renvoize 2013-12-04 09:50:40 UTC
Created attachment 23285 [details] [review]
[PASSED QA] Bug 10944 - Followup for Bootstrap Amazon images on https OPAC

see test plan for previous patch, only bootstrap theme instead of prog. :)

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 19 Liz Rea 2014-01-23 02:12:58 UTC Comment hidden (obsolete)
Comment 20 Liz Rea 2014-01-23 02:26:15 UTC
Should add that while I was in there I added the reference to the amazonTLD systempref.
Comment 21 Liz Rea 2014-01-29 20:28:54 UTC
Comment on attachment 24633 [details] [review]
Bug 10944 - opac-user and opac-readingrecord had instances of non-https amazon images

I think the amazonTLD preference isn't working properly, so I'll submit a new patch without that additional change.
Comment 22 Galen Charlton 2014-05-05 03:32:42 UTC
Pushed to master.  Thanks, Liz and Robin!