Bug 17103 - Google API Loader jsapi called over http
Summary: Google API Loader jsapi called over http
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P3 trivial (vote)
Target Milestone: ---
Assignee: Indranil Das Gupta
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-10 19:27 UTC by Indranil Das Gupta
Modified: 2017-12-07 22:16 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: String patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 17103 - Google API Loader jsapi called over http (1.77 KB, patch)
2016-08-12 01:00 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
Bug 17103 - Google API Loader jsapi called over http (1.77 KB, patch)
2016-08-13 00:29 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
Bug 17103 - Google API Loader jsapi called over http (1.78 KB, patch)
2016-08-13 00:40 UTC, Indranil Das Gupta
Details | Diff | Splinter Review
Bug 17103 - Google API Loader jsapi called over http (1.83 KB, patch)
2016-08-13 01:11 UTC, M. Tompsett
Details | Diff | Splinter Review
[PASSED QA] Bug 17103 - Google API Loader jsapi called over http (1.90 KB, patch)
2016-08-14 12:01 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Indranil Das Gupta 2016-08-10 19:27:33 UTC
Google API loader js included in opac-bottom.inc is called over HTTP. This is setting off MIXED CONTENT error on OPACs served over SSL. Directly impacts GoogleIndicTransliteration syspref which stops working on SSLized OPACs. This syspref is used extensively across Indian libraries to perform searches in Indian languages. While the fix is trivial, non availability of the feature is a deal breaker. Patch follows.
Comment 1 Indranil Das Gupta 2016-08-12 01:00:51 UTC Comment hidden (obsolete)
Comment 2 M. Tompsett 2016-08-13 00:18:09 UTC
Comment on attachment 54321 [details] [review]
Bug 17103 - Google API Loader jsapi called over http

Review of attachment 54321 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/includes/opac-bottom.inc
@@ +209,4 @@
>      </script>
>  [% END %]
>  [% IF ( GoogleIndicTransliteration ) %]
> +    <script type="text/javascript" src="//www.google.com/jsapi"></script>

I was expecting https:// not just //. This should work, but only because google and/or your browser makes it work. Explicit is always best.
Comment 3 Indranil Das Gupta 2016-08-13 00:29:39 UTC Comment hidden (obsolete)
Comment 4 Indranil Das Gupta 2016-08-13 00:40:32 UTC Comment hidden (obsolete)
Comment 5 M. Tompsett 2016-08-13 01:11:41 UTC Comment hidden (obsolete)
Comment 6 Katrin Fischer 2016-08-14 12:01:43 UTC
Created attachment 54427 [details] [review]
[PASSED QA] Bug 17103 - Google API Loader jsapi called over http

This patch replaces the hardcoded protocol ("http") from the URI with
https since that is what Google defacto uses to serve JS resources
Prevents MIXED CONTENT failure, allowing GoogleIndicTransliteration
to function correctly when used in SSLized OPACs.

Test plan
---------

1/ Make sure your OPAC is being served both over HTTP and HTTPS
2/ Set GoogleIndicTransliteration syspref to "Show"
3/ Access the OPAC over http, Google transliteration element will
   show up in masthead searchbox.
4/ Access the OPAC over https. The element will not show. Console
   will show MIXED CONTENT error and failure of google loader.
5/ Apply patch. Repeat steps #3 and #4 again. Now in both cases
   GoogleIndicTransliteration will work.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 7 Kyle M Hall 2016-08-17 17:59:33 UTC
Pushed to master for 16.11, thanks Indranil!
Comment 8 Frédéric Demians 2016-08-23 10:24:47 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 9 Julian Maurice 2016-08-24 10:29:28 UTC
Pushed to 3.22.x, will be in 3.22.10