[Bug 23874] New: Advanced Editor is not loaded over HTTPS
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Bug ID: 23874 Summary: Advanced Editor is not loaded over HTTPS Change sponsored?: --- Product: Koha Version: 19.05 Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: Cataloging Assignee: koha-bugs@lists.koha-community.org Reporter: fraktik@gmail.com QA Contact: testopia@bugs.koha-community.org CC: m.de.rooy@rijksmuseum.nl Symptoms: Loading, please wait... Editor of record is visually loaded in background, but over it is big endless running circle with announcement: "Loading, please wait... Source of problem: The script is by default blocked by browsers because there is some hardlink to HTTP content. Another details: - This is related both to 18.05 and 19.05, Firefox and Chrome, Win10 and Ubuntu, and it's behaving practically same. - We have in general disabled (forwarded) all unsecured traffic to https at our nginx rproxy server. Console output: Blocked loading mixed active content “http://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?callback=define” editor.pl The resource from “https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define” was blocked due to MIME type (“text/html”) mismatch (X-Content-Type-Options: nosniff). editor.pl <script> source URI is not allowed in this document: “https://demo.koha.cz/cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define”. editor.pl:1:1 Error: Script error for: /cgi-bin/koha/svc/cataloguing/framework?frameworkcode=&callback=define http://requirejs.org/docs/errors.html#scripterror -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Tomáš Wünsch <fraktik@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P4 Severity|enhancement |minor -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #1 from Tomáš Wünsch <fraktik@gmail.com> --- Created attachment 94565 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=94565&action=edit printscreen of security failure -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #2 from Tomáš Wünsch <fraktik@gmail.com> --- Created attachment 94578 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=94578&action=edit printscreen from console - http needed on https connection -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #3 from Tomáš Wünsch <fraktik@gmail.com> --- temporary solution: - about:config in FF - security.mixed_content.block_active_content setup to "false". -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de --- Comment #4 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- I can't replicate this issue on 18.11.10 - any more clues on where the hardcoded bit is hiding? -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #5 from Tomáš Wünsch <fraktik@gmail.com> --- Not sure how to help. You can login into our 19.05: https://demo.koha.cz/ user demo passwd demo -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #6 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Tomáš Wünsch from comment #5)
Not sure how to help. You can login into our 19.05: https://demo.koha.cz/ user demo passwd demo
Hi Tomas, the Advanced Editor appears to be turned off on that one and I don't have access to the system preferences with that login. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #7 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- (In reply to Katrin Fischer from comment #6)
(In reply to Tomáš Wünsch from comment #5)
Not sure how to help. You can login into our 19.05: https://demo.koha.cz/ user demo passwd demo
Hi Tomas, the Advanced Editor appears to be turned off on that one and I don't have access to the system preferences with that login.
I've tested in the Catalyst demo that uses https, but the Advanced editor loads: https://demo-intra.mykoha.co.nz/cgi-bin/koha/cataloguing/editor.pl#new/ (https://koha-community.org/demo/) Tested in Firefox on Ubuntu. Did I miss something form the test plan? -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #8 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Created attachment 95274 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=95274&action=edit Bug 23874: Fix advanced editor if nosniff is set -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|19.05 |master CC| |jonathan.druart@bugs.koha-c | |ommunity.org Status|NEW |Needs Signoff Assignee|koha-bugs@lists.koha-commun |jonathan.druart@bugs.koha-c |ity.org |ommunity.org --- Comment #9 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Hi Tomáš, can you try this patch please? I am pretty sure we will need to adjust much more occurrences. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Advanced Editor is not |Advanced Editor is not |loaded over HTTPS |loaded if | |X-Content-Type-Options: | |nosniff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 --- Comment #10 from Marcel de Rooy <m.de.rooy@rijksmuseum.nl> --- (In reply to Jonathan Druart from comment #8)
Created attachment 95274 [details] [review] Bug 23874: Fix advanced editor if nosniff is set
Hi Jonathan, I am curious why this makes a difference? The fact that you ask to return JSON does not make it a different GET request? Marcel Just for reference: jQuery.get( url [, data ] [, success ] [, dataType ] ) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |ASSIGNED --- Comment #11 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- Hum I think my tests were wrong yesterday. I thought I saw a content type text/html before this patch, then json. But I cannot replicate this. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEW Assignee|jonathan.druart@bugs.koha-c |koha-bugs@lists.koha-commun |ommunity.org |ity.org -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Marjorie Barry-Vila <marjorie.barry-vila@collecto.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marjorie.barry-vila@collect | |o.ca -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23874 Kyle M Hall (khall) <kyle@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WORKSFORME CC| |kyle@bywatersolutions.com Status|NEW |RESOLVED -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org