FriendsOfFlarum Secure HTTPS

datitisev

010101 Can you post an example URL of the GIF link that produces a 404 error?

010101

With this extension:

https://www.sitbreathe.be/api/fof/secure-https/https%3A%2F%2Fmedia3.giphy.com%2Fmedia%2F13DMEAmpAngKDC%2Fgiphy-downsized.gif%3Fcid%3D41e3ab5fqj88y8qsqr1h6lp1osn4t4qd556slr360etooi1u%26rid%3Dgiphy-downsized.gif

Without:

https://media2.giphy.com/media/lkK7hFTOp1s4g/giphy.gif?cid=41e3ab5flt7uolqt9u699djyl6zft88rjqdgc3qzfu0j9k02&rid=giphy.gif

P.S. I don’t have any issues with regular images and other embeds with this extension enabled. Maybe Giphy does something weird on their end which makes things like this not work. Who knows.

karaok

0.2.0

beta 14 ready 🥳

Update

composer require fof/secure-https:^0.2.0
php flarum cache:clear

karaok

0.2.1

address early resolving issue, which resulted in 404 errors for extensions loaded afterwards (@Communitybuilder @shaggykiwi @Pollux ) - Thank you @clarkwinkelmann for discovering the problem 👍️

Updating

composer require fof/secure-https:^0.2.1

Communitybuilder

karaok yayyyy from now i wanna become a bounty tracker for karaok <3 😃

IanM

0.3.0

Flarum beta 15 support

SKevo

Error on beta.15:

flarum.ERROR: RuntimeException: Tag 'IMG' does not exist in /app/vendor/s9e/text-formatter/src/Configurator/Collections/TagCollection.php:34
Stack trace:
#0 /app/vendor/s9e/text-formatter/src/Configurator/Collections/NormalizedCollection.php(185): s9e\TextFormatter\Configurator\Collections\TagCollection->getNotExistException('IMG')
#1 /app/vendor/s9e/text-formatter/src/Configurator/Collections/NormalizedCollection.php(241): s9e\TextFormatter\Configurator\Collections\NormalizedCollection->get('IMG')
#2 /app/vendor/fof/secure-https/src/Listeners/ModifyContentHtml.php(42): s9e\TextFormatter\Configurator\Collections\NormalizedCollection->offsetGet('IMG')
#3 /app/vendor/illuminate/events/Dispatcher.php(369): FoF\SecureHttps\Listeners\ModifyContentHtml->configuring(Object(Flarum\Formatter\Event\Configuring))
#4 /app/vendor/illuminate/events/Dispatcher.php(218): Illuminate\Events\Dispatcher->Illuminate\Events\{closure}('Flarum\\Formatte...', Array)
#5 /app/vendor/flarum/core/src/Formatter/Formatter.php(157): Illuminate\Events\Dispatcher->dispatch('Flarum\\Formatte...')
#6 /app/vendor/flarum/core/src/Formatter/Formatter.php(192): Flarum\Formatter\Formatter->getConfigurator()
#7 /app/vendor/illuminate/cache/Repository.php(418): Flarum\Formatter\Formatter->Flarum\Formatter\{closure}()
#8 /app/vendor/flarum/core/src/Formatter/Formatter.php(193): Illuminate\Cache\Repository->rememberForever('flarum.formatte...', Object(Closure))
#9 /app/vendor/flarum/core/src/Formatter/Formatter.php(236): Flarum\Formatter\Formatter->getComponent('js')
#10 /app/vendor/flarum/core/src/Forum/ForumServiceProvider.php(105): Flarum\Formatter\Formatter->getJs()
#11 [internal function]: Flarum\Forum\ForumServiceProvider->Flarum\Forum\{closure}()
#12 /app/vendor/flarum/core/src/Frontend/Compiler/Source/StringSource.php(35): call_user_func(Object(Closure))
#13 /app/vendor/flarum/core/src/Frontend/Compiler/Source/StringSource.php(46): Flarum\Frontend\Compiler\Source\StringSource->getContent()
#14 /app/vendor/flarum/core/src/Frontend/Compiler/RevisionCompiler.php(239): Flarum\Frontend\Compiler\Source\StringSource->getCacheDifferentiator()
#15 /app/vendor/flarum/core/src/Frontend/Compiler/RevisionCompiler.php(73): Flarum\Frontend\Compiler\RevisionCompiler->calculateRevision(Array)
#16 /app/vendor/flarum/core/src/Frontend/Compiler/RevisionCompiler.php(125): Flarum\Frontend\Compiler\RevisionCompiler->commit()
#17 /app/vendor/fof/nightmode/src/Content/Assets.php(119): Flarum\Frontend\Compiler\RevisionCompiler->getUrl()
#18 [internal function]: FoF\NightMode\Content\Assets->FoF\NightMode\Content\{closure}(Object(Flarum\Frontend\Compiler\JsCompiler))
#19 /app/vendor/fof/nightmode/src/Content/Assets.php(120): array_map(Object(Closure), Array)
#20 /app/vendor/fof/nightmode/src/Content/Assets.php(55): FoF\NightMode\Content\Assets->getUrls(Array)
#21 /app/vendor/flarum/core/src/Frontend/Frontend.php(63): FoF\NightMode\Content\Assets->__invoke(Object(Flarum\Frontend\Document), Object(Laminas\Diactoros\ServerRequest))
#22 /app/vendor/flarum/core/src/Frontend/Frontend.php(55): Flarum\Frontend\Frontend->populate(Object(Flarum\Frontend\Document), Object(Laminas\Diactoros\ServerRequest))
#23 /app/vendor/flarum/core/src/Frontend/Controller.php(32): Flarum\Frontend\Frontend->document(Object(Laminas\Diactoros\ServerRequest))
#24 /app/vendor/flarum/core/src/Http/RouteHandlerFactory.php(38): Flarum\Frontend\Controller->handle(Object(Laminas\Diactoros\ServerRequest))
#25 /app/vendor/flarum/core/src/Http/Middleware/ExecuteRoute.php(27): Flarum\Http\RouteHandlerFactory->Flarum\Http\{closure}(Object(Laminas\Diactoros\ServerRequest), Array)
#26 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ExecuteRoute->process(Object(Laminas\Diactoros\ServerRequest), Object(Closure))
#27 /app/vendor/fof/oauth/src/Middleware/ErrorHandler.php(50): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#28 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): FoF\OAuth\Middleware\ErrorHandler->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#29 /app/vendor/fof/masquerade/src/Middleware/DemandProfileCompletion.php(58): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#30 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): FoF\Masquerade\Middleware\DemandProfileCompletion->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#31 /app/vendor/fof/secure-https/src/Middlewares/ContentSecurityPolicyMiddleware.php(32): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#32 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): FoF\SecureHttps\Middlewares\ContentSecurityPolicyMiddleware->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#33 /app/vendor/flarum/core/src/Http/Middleware/ShareErrorsFromSession.php(57): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#34 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ShareErrorsFromSession->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#35 /app/vendor/flarum/core/src/Http/Middleware/CheckCsrfToken.php(40): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#36 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\CheckCsrfToken->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#37 /app/vendor/flarum/core/src/Http/Middleware/ResolveRoute.php(67): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#38 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ResolveRoute->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#39 /app/vendor/flarum/core/src/Http/Middleware/SetLocale.php(50): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#40 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\SetLocale->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#41 /app/vendor/flarum/core/src/Http/Middleware/AuthenticateWithSession.php(32): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#42 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\AuthenticateWithSession->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#43 /app/vendor/flarum/core/src/Http/Middleware/RememberFromCookie.php(51): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#44 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\RememberFromCookie->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#45 /app/vendor/flarum/core/src/Http/Middleware/StartSession.php(61): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#46 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\StartSession->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#47 /app/vendor/flarum/core/src/Http/Middleware/CollectGarbage.php(46): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#48 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\CollectGarbage->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#49 /app/vendor/flarum/core/src/Http/Middleware/ParseJsonBody.php(28): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#50 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\ParseJsonBody->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#51 /app/vendor/migratetoflarum/canonical/src/Middlewares/CanonicalRedirectMiddleware.php(49): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#52 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): MigrateToFlarum\Canonical\Middlewares\CanonicalRedirectMiddleware->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#53 /app/vendor/flarum/core/src/Http/Middleware/HandleErrors.php(57): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#54 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Flarum\Http\Middleware\HandleErrors->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#55 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#56 /app/vendor/middlewares/request-handler/src/RequestHandler.php(84): Laminas\Stratigility\MiddlewarePipe->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#57 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\RequestHandler->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#58 /app/vendor/middlewares/base-path-router/src/BasePathRouter.php(97): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#59 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePathRouter->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#60 /app/vendor/laminas/laminas-stratigility/src/Middleware/OriginalMessages.php(42): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#61 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Laminas\Stratigility\Middleware\OriginalMessages->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#62 /app/vendor/middlewares/base-path/src/BasePath.php(53): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#63 /app/vendor/laminas/laminas-stratigility/src/Next.php(61): Middlewares\BasePath->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\Next))
#64 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(84): Laminas\Stratigility\Next->handle(Object(Laminas\Diactoros\ServerRequest))
#65 /app/vendor/laminas/laminas-stratigility/src/MiddlewarePipe.php(73): Laminas\Stratigility\MiddlewarePipe->process(Object(Laminas\Diactoros\ServerRequest), Object(Laminas\Stratigility\EmptyPipelineHandler))
#66 /app/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(96): Laminas\Stratigility\MiddlewarePipe->handle(Object(Laminas\Diactoros\ServerRequest))
#67 /app/vendor/flarum/core/src/Http/Server.php(42): Laminas\HttpHandlerRunner\RequestHandlerRunner->run()
#68 /app/public/index.php(22): Flarum\Http\Server->listen()
#69 {main}

Makes the forum unable to load. When disabling this extension, everything's okay. Not sure what went wrong, I am happy to provide more info if needed. Might be FreeFlarum's PHP version, or that we have outdated package(s) with missing functions.

clarkwinkelmann

SKevo I think this error happens if bbcode and/or markdown are disabled, or if they are enabled after this extension. Enable bbcode/markdown first, then this extension.

We might need better error handling for that, or maybe use the extension requirement feature of Flarum beta 14.

SKevo

clarkwinkelmann I'd suggest to use the requirement feature. It's quick, plus many people (FreeFlarum forum admins included) do not know about the loading order.

clarkwinkelmann

SKevo I don't know much about this extension, so I can't say for sure.

If the extension works with either bbcode or markdown, then we can't use the feature because that would force users of the extensions to enable a particular one or both when they might only want one of the two.

If this extension only works with one of them however using the feature to depend on the other extension would make total sense.

We could possibly to a custom check in the onEnable hook of the extension, similarly to how extension dependencies work.

SKevo

clarkwinkelmann I see what you mean, and I can't tell if it works with one or another or both, but seems like it could work with only BBCode. But then, when we insert an image with markdown, it has to work with that too, so I'm not sure.

Ffuser1

clarkwinkelmann
My observation.
If I install or update any extension with the image proxy settings enabled, it takes the site down with the same error someone posted above.
If I clear cache with the image proxy settings set, it breaks the site as well.
In doing so, all login users have to login again as their session is abruptly terminated.

@datitisev

Dusty

I was looking for 30 minutes because of what my site died, horror!

IanM

1.0.0

Flarum 1.0 compatibility
Improve http->https proxy by using guzzle
Ensure image compatibility even after extension is disabled. Now uses the textformatter->render

Installation

composer require fof/secure-https:"*"
php flarum cache:clear

neko

i am getting a permission error for users that aren't administrators. is there a setting for this that i am missing?

clarkwinkelmann

neko thanks for the report. This seems to be an oversight on our part during the last Flarum update.

We'll need to fix this in the extension. I have created a GitHub issue with the cause FriendsOfFlarum/secure-https16

IanM

1.1.0

chore: webpack 5 FriendsOfFlarum/secure-https18
fix: Use correct permission for proxy FriendsOfFlarum/secure-https19 (neko )
chore: Use default settings extender FriendsOfFlarum/secure-https20

Updating

composer require fof/secure-https:"*"
php flarum cache:clear

Wellwisher

Great mod. Thanks.

huguadao

The picture preview of the v17development/flarum-blog plug-in has not been proxied

After installing and enabling the v17development/flarum-blog plug-in, the picture preview in the blog list and the header picture of the specific blog page (which is a picture with the list preview) are not proxied, and the picture source of http protocol is not displayed

截屏2022-11-27 11.53.50

截屏2022-11-27 11.51.58

截屏2022-11-27 12.00.20

SKevo

Profile image cannot be uploaded when this extension is enabled on FreeFlarum forums. Console:

Refused to load the image 'blob:https://www.forum.tld/d59515fe-733d-46e7-8730-4e1ef7a0da54' because it violates the following Content Security Policy directive: "img-src https: data:".

index.js:122 Uncaught (in promise) Error: ImageBlobReduce: failed to create Image() from blob
    at t.image.onerror (index.js:122:46)

Disabling the extension solves the issue. No server-side logs. PHP Flarum info:

Flarum core 1.6.2
PHP version: 8.1.2-1ubuntu2.8
MySQL version: 5.5.5-10.9.3-MariaDB-1:10.9.3+maria~ubu2204
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, pcntl, Reflection, SPL, session, standard, sodium, mysqlnd, PDO, xml, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, gmp, iconv, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xmlreader, xmlwriter, xsl, zip, Zend OPcache
+----------------------------------+---------+--------+
| Flarum Extensions                |         |        |
+----------------------------------+---------+--------+
| ID                               | Version | Commit |
+----------------------------------+---------+--------+
| flarum-tags                      | v1.6.1  |        |
| flarum-sticky                    | v1.6.1  |        |
| flarum-suspend                   | v1.6.1  |        |
| fof-pages                        | 1.0.4   |        |
| flarum-flags                     | v1.6.1  |        |
| flarum-markdown                  | v1.6.1  |        |
| v17development-seo               | v1.8.0  |        |
| the-turk-stickiest               | 3.0.1   |        |
| the-turk-flamoji                 | 1.0.4   |        |
| the-turk-diff                    | 1.1.2   |        |
| sycho-profile-cover              | v1.3.3  |        |
| sycho-move-posts                 | v0.1.7  |        |
| migratetoflarum-canonical        | 1.0.0   |        |
| justoverclock-username-blacklist | 0.1.0   |        |
| justoverclock-hashtag            | 1.0.1   |        |
| jslirola-login2seeplus           | v0.2.1  |        |
| ianm-syndication                 | 1.2.2   |        |
| fof-user-directory               | 1.2.3   |        |
| fof-user-bio                     | 1.1.1   |        |
| fof-upload                       | 1.2.3   |        |
| fof-stopforumspam                | 1.2.3   |        |
| fof-split                        | 1.1.0   |        |
| fof-socialprofile                | 1.1.4   |        |
| fof-sitemap                      | 2.0.1   |        |
| fof-secure-https                 | 1.1.0   |        |
| fof-reactions                    | 1.1.3   |        |
| fof-profile-image-crop           | 1.1.0   |        |
| fof-polls                        | 1.3.0   |        |
| fof-nightmode                    | 1.5.1   |        |
| fof-moderator-notes              | 1.1.0   |        |
| fof-merge-discussions            | 1.3.1   |        |
| fof-ignore-users                 | 1.1.0   |        |
| fof-formatting                   | 1.0.2   |        |
| fof-discussion-thumbnail         | 1.1.0   |        |
| fof-default-user-preferences     | 1.2.0   |        |
| fof-default-group                | 1.1.0   |        |
| fof-byobu                        | 1.1.8   |        |
| fof-best-answer                  | 1.2.4   |        |
| fof-bbcode-details               | 1.1.0   |        |
| flarum-subscriptions             | v1.6.1  |        |
| flarum-statistics                | v1.6.1  |        |
| flarum-pusher                    | v1.6.1  |        |
| flarum-mentions                  | v1.6.1  |        |
| flarum-lock                      | v1.6.1  |        |
| flarum-lang-turkish              | 1.12.0  |        |
| flarum-lang-swedish              | 1.1.1   |        |
| flarum-lang-spanish              | 1.5.0   |        |
| flarum-lang-polish               | v1.0.9  |        |
| flarum-lang-italian              | 1.9.0   |        |
| flarum-lang-german               | 1.4.6   |        |
| flarum-lang-french               | v4.4.0  |        |
| flarum-lang-english              | v1.6.0  |        |
| flarum-lang-brazilian            | 1.4.0   |        |
| flarum-emoji                     | v1.6.1  |        |
| flarum-bbcode                    | v1.6.0  |        |
| davwheat-custom-sidenav-links    | 1.0.1   |        |
| datlechin-signup-button          | v0.1.1  |        |
| datlechin-scroll-buttons         | v1.1.0  |        |
| datlechin-keyboard-shortcuts     | v0.1.1  |        |
| askvortsov-rich-text             | v2.1.7  |        |
| askvortsov-pwa                   | v3.1.3  |        |
| askvortsov-moderator-warnings    | v0.6.1  |        |
| askvortsov-markdown-tables       | v1.2.1  |        |
| askvortsov-categories            | v3.0.6  |        |
| acpl-mobile-tab                  | 1.1.1   |        |
+----------------------------------+---------+--------+
Base URL: https://[redacted]
Installation path: /mnt/data-new/host/[redacted]
Queue driver: sync
Session driver: file
Mail driver: smtp
Debug mode: off

clarkwinkelmann

SKevo I'm not sure there will be any good solution to this problem.

Secure HTTPS forces a content security policy on the forum that is very likely to break other extensions, not just avatars.

The easiest "solution" would be to add a toggle to disable the CSP header, but then the forum owner would be responsible for adding their own CSP, which they probably won't do, and therefore negate a big part of this extension security.

Dynamically augmenting the CSP rule based on the set of enabled extensions will likely be too complex to maintain.

I'm not entirely sure where avatars could fail with the current CSP though. The error message suggests the avatar image is being drawn on a canvas. I can think of 2 features that do this: the color-thief implementation that picks the profile page background (happens on every page load, not only avatar change) or the avatar crop extension.

Since I see fof-profile-image-crop in the php flarum info output I would guess that's where the CSP incompatibility lies. I'm not sure which CSP change would be needed for that. I suppose it's opening the uploaded binary data as an image directly and data: doesn't cover it.

« Previous Page Next Page »