Symptoms: Loading, please wait... Editor of record is visually loaded in background, but over it is big endless running circle with announcement: "Loading, please wait... Source of problem: The script is by default blocked by browsers because there is some hardlink to HTTP content. Another details: - This is related both to 18.05 and 19.05, Firefox and Chrome, Win10 and Ubuntu, and it's behaving practically same. - We have in general disabled (forwarded) all unsecured traffic to https at our nginx rproxy server. Console output: Blocked loading mixed active content “http://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?callback=define” editor.pl The resource from “https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define” was blocked due to MIME type (“text/html”) mismatch (X-Content-Type-Options: nosniff). editor.pl <script> source URI is not allowed in this document: “https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define”. editor.pl:1:1 Error: Script error for: /cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define http://requirejs.org/docs/errors.html#scripterror
Created attachment 94565 [details] printscreen of security failure
Created attachment 94578 [details] printscreen from console - http needed on https connection
temporary solution: - about:config in FF - security.mixed_content.block_active_content setup to "false".
I can't replicate this issue on 18.11.10 - any more clues on where the hardcoded bit is hiding?
Not sure how to help. You can login into our 19.05: https://demo.koha.cz/ user demo passwd demo
(In reply to Tomáš Wünsch from comment #5) > Not sure how to help. You can login into our 19.05: > https://demo.koha.cz/ > user demo > passwd demo Hi Tomas, the Advanced Editor appears to be turned off on that one and I don't have access to the system preferences with that login.
(In reply to Katrin Fischer from comment #6) > (In reply to Tomáš Wünsch from comment #5) > > Not sure how to help. You can login into our 19.05: > > https://demo.koha.cz/ > > user demo > > passwd demo > > Hi Tomas, the Advanced Editor appears to be turned off on that one and I > don't have access to the system preferences with that login. I've tested in the Catalyst demo that uses https, but the Advanced editor loads: https://demo-intra.mykoha.co.nz/cgi-bin/koha/cataloguing/editor.pl#new/ (https://koha-community.org/demo/) Tested in Firefox on Ubuntu. Did I miss something form the test plan?
Created attachment 95274 [details] [review] Bug 23874: Fix advanced editor if nosniff is set
Hi Tomáš, can you try this patch please? I am pretty sure we will need to adjust much more occurrences.
(In reply to Jonathan Druart from comment #8) > Created attachment 95274 [details] [review] [review] > Bug 23874: Fix advanced editor if nosniff is set Hi Jonathan, I am curious why this makes a difference? The fact that you ask to return JSON does not make it a different GET request? Marcel Just for reference: jQuery.get( url [, data ] [, success ] [, dataType ] )
Hum I think my tests were wrong yesterday. I thought I saw a content type text/html before this patch, then json. But I cannot replicate this.