Bug 21094 - Syndetics: always use https instead of http
Summary: Syndetics: always use https instead of http
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 17137
  Show dependency treegraph
 
Reported: 2018-07-19 16:43 UTC by Owen Leonard
Modified: 2020-08-05 14:02 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 21094: Syndetics: always use https instead of http (26.32 KB, patch)
2018-07-19 17:56 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 21094: Syndetics: always use https instead of http (26.41 KB, patch)
2018-07-26 14:12 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 21094: Syndetics: always use https instead of http (26.42 KB, patch)
2018-08-01 22:47 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Owen Leonard 2018-07-19 16:43:33 UTC
As per bug 17137, we should be using SSL for all external resources.
Comment 1 Owen Leonard 2018-07-19 17:56:59 UTC
Created attachment 77140 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.
Comment 2 Kyle M Hall 2018-07-26 14:12:22 UTC
Created attachment 77292 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.

Signed-off-by: John Doe <you@example.com>
Comment 3 Katrin Fischer 2018-08-01 22:47:24 UTC
Created attachment 77416 [details] [review]
Bug 21094: Syndetics: always use https instead of http

This patch removes the 'using_https' check in OPAC templates in calls to
Syndetics resources. Instead, https is always used.

To test, apply the patch and enable Syndetics-related preferences. View
the following pages in the OPAC:

- Bibliographic detail page
  - Browse shelf section of the bibliographic detail page
- Search results
- List contents
- Recent comments
  - Recent comments RSS
- User summary page
  - Circulation history

NOTE: I tested with made-up Syndetics credentials. This means my changes
didn't make the template explode, but it doesn't confirm conclusively
that the resources work.

Signed-off-by: John Doe <you@example.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 4 Tomás Cohen Arazi 2018-08-02 13:19:02 UTC
Pushed to master. Thanks!
Comment 5 Martin Renvoize 2018-08-03 14:20:04 UTC
Pushed to 18.05.x for 18.05.03. 

I've altered this from 'enhancement' to 'bug - minor'... it's a simple patch and improves security and user experience with zero detrimental effects.
Comment 6 Fridolin Somers 2018-09-21 09:56:06 UTC
Pushed to 17.11.x for 17.11.10
Comment 7 Marcel de Rooy 2020-08-05 14:02:14 UTC
Seems that this patch effectively eliminated the use of using_https while we still have it in C4/Auth..
See also bug 25360