I have tested this item ? unsuccessfully on 5ceaed7

While code changes look fine, after applying patch using patch-tester backend logo is not getting loaded

Before

After

I have removed the svg files from this PR

I have tested this item ✅ successfully on e83032f

For some reasons applying this patch using patch tester was not working. Not all files were getting patch applied to (eg - no changes were seen in /templates/cassiopeia/offline.php)

So I tested by applying patch manually as

git apply 31328.diff

thanks @PhilETaylor

I have tested this item ✅ successfully on 6133e42

I have tested this item ✅ successfully on 6133e42

RTC

This is wrong because http://www.w3.org/2001/XMLSchema-instance is a name space not an URI, so changing it would break the schema. Revert this part or find an updated document with an https URI, I didn't found any.

change made as requested by @HLeithner

Thanks

Not going to pretend that I 100% understood

PhilETaylor
that's because @HLeithner is actually wrong.
http://www.w3.org/2001/XMLSchema-instance actually is hard redirected to https://www.w3.org/2001/XMLSchema-instance when you visit it, the non-https version no longer exists as a namespace.

why did you deleted your comment @PhilETaylor

because I was drafting another one, with more details... but as this is already merged there is no point.

This is wrong because http://www.w3.org/2001/XMLSchema-instance is a name space not an URI,

It is a URI retrieved using the standard mechanisms of the Web (e.g. http, https, etc.)

Using the http or https version of the name space is perfectly acceptable. There was no reason for it to be reverted.

http://www.w3.org/2001/XMLSchema-instance redirects to https://www.w3.org/2001/XMLSchema-instance

Their content is the same. It makes no difference if the namespace is loaded over https or http, the result is the same.

in fact the response contains content-security-policy: upgrade-insecure-requests so most secure clients/browsers would auto upgrade to https anyway

The actual targetNamespace="http://www.w3.org/2001/XMLSchema-instance" in the retrieved document remains HTTP and not HTTPS regardless of the http protocol used to retrieve the namespace document.

https://www.w3.org/TR/xmlschema-1/ states:

4.3.1 Standards for representation of schemas and retrieval of schema documents on the Web

For interoperability, serialized ·schema documents·, like all other Web resources, may be identified by URI and retrieved using the standard mechanisms of the Web (e.g. http, https, etc.) Such documents on the Web must be part of XML documents (see clause 1.1), and are represented in the standard XML schema definition form described by layer 2 (that is as element information items).