[#5478] - Https links
- Closed
- 22 Dec 2014
- Medium
- Build: staging
- # 5478
- Diff
- J0WI:https-links
User tests: Successful: Unsuccessful:
Based on #5415 (comment)
I excluded extension.joomla.org, because it does support https on all paths.
| Labels |
Added:
?
|
||
What's the reason to not change this string? It won't break anything.
I hope this change will force the joomla.org content team to update hardcoded http links and finally move the whole site to https only. IMHO it's not our failure if a site has mixed content issues.
This change referrers to the HTTPS-Everywhere project:
https://github.com/EFForg/https-everywhere/blob/master/src/chrome/content/rules/Joomla.xml
https://github.com/EFForg/https-everywhere/blob/master/src/chrome/content/rules/JoomlaCode.org.xml
The sites themselves are in the process of being updated. I'm not in favor of just batch updating the links for the sake of doing so and in some cases causing sites to appear broken. Even "simpler" sites like our API subdomain took several hours of review before being converted to HTTPS only; the large domains like www and community may take several days of someone reviewing full time for full compatibility.
From what I can tell, references to docs (which is already forcing HTTPS) and the help.joomla.org/proxy installation can be safely updated now. Other installations should not be updated until they have been fully reviewed and certified to work correctly.
Right now, the only two sites I know which are fully https are api.joomla.org through rewrite and docs.joomla.org. Actually docs isn't reachable by http at all, port 80 is completely unavailable and all incoming to http are forwarded to https with a 301.
I would be in favor of closing this and starting over. Only include sites known to be working.
help.j and help.j.org/proxy are 2 completely different installs. I have no access or knowledge as to their status.
help.joomla.org/proxy itself seems to be fine for what content it's serving to the CMS (I've done some checks).
The main help site seems fine, a couple mixed content messages on images from the shop which don't exist though.
Closing this as we need to change the links on a per site base.
Also I wonder if it makes sense to have https links to sites which are basically readonly for most visitors. Imho there is not much point in forcing https for sites like joomla.org where people never transmit any sensitive data.
| Status | Pending | ⇒ | Closed |
Set to "closed" on behalf of @zero-24 by The JTracker Application at issues.joomla.org/joomla-cms/5478
Closing this as we need to change the links on a per site base.
Realy closing now 
This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/5478.
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2014-12-22 18:31:30 |
We are working on it. In terms of what is linked from the CMS, I think we have captured everything at the moment that is ready.
joomla.org sites linked by the CMS repo:
- www.joomla.org - Mixed Content Issues (note that this issue does not apply to the RSS feeds, which can safely be updated (see #5712)
- issues.joomla.org - Unsupported (server does not have SSL cert installed)
- developer.joomla.org - Unsupported (server does not have SSL cert installed)
- build.joomla.org - Unsupported (server does not have SSL cert installed)
- docs.joomla.org - Links updated, site forces HTTPS
- demo.joomla.org - Site itself forces SSL, links can be updated
- community.joomla.org - Mixed Content Issues
- extensions.joomla.org - Unsupported (redirected to HTTP)
- forum.joomla.org - Several issues (cert identity mismatch, submitting to HTTP from HTTPS, mixed content)
- resources.joomla.org - Mixed Content Issues (causes the front page to appear broken)
- update.joomla.org - Unsupported (redirects to CDN provider)
- help.joomla.org - The links for the help proxy sub-directory have been updated and it is forcing HTTPS, the main site is in Joomla's offline mode
Just blanket changing all the links IMO is not an option. It looks just as bad on the project to serve links to known broken pages as not having fully enabled HTTPS sites. As I've said, it is a work in progress (sites are getting updated and forcing HTTPS connections as appropriate), but it's something that takes time with a domain as large as Joomla's.
Global search and replaces are BAD, BAD, BAD
The first language string change I checked made no sense to change
On 20 December 2014 at 18:35, J0WI notifications@github.com wrote:
Brian Teeman
Co-founder Joomla! and OpenSourceMatters Inc.
http://brian.teeman.net/