Davis Secure Https

Davis

Secure Https

by Davis

Disallows images to be displayed over http. This keeps the green lock at the top of your broswer 🙂 The extension can either proxy http images through your https or display this error:

Install

composer require davis/flarum-ext-securehttps

Disclaimer

This extension is ~~still in beta~~ abandoned. Please refrain from using in a production environment.

To Do

~~Proxy non https images through php~~

Kulga

Interesting!
Does it try to "attempt" a https pull before declaring that it is disallowing the image?

Davis

Kulga That's actually what it does! It rewrites the links as https and hides it if it throws an error, so that if users link an image with http and the site supports https (in a lot of cases imgur) it will still work.

Kulga

Very cool, works as expected! (Had to look for a bit for a non-http image link ?)
There seems to be a lingering static Loading Image for loaded images when it rewrites http links

Davis

Kulga Fixed. Try updating

Kulga

yup - that resolved it ?

Nice to keep that green lock ?

Kakifrucht

Did this inspire you to write this extension?

Davis

Kakifrucht lol yes

Davis

Version 0.1.0beta3 released!

Added
+ Ability to proxy non https images through https
+ Ability to open images even if they are http button (when not proxying)

datitisev

Davis Could you give a screenshot of the new update?
Thanks!

Davis

datitisev I updated the screenshot in the main post.

It looks basically the same. Images that are proxied look just like regular images.

Arie

I just installed this plugin, when I enable the proxy feature it goes wrong. It links to:

https://mydomain.tld/api/davis/securehttps/i.imgur.com%2Fu4L2AzX.jpg/

I've only replaced my domain in this url and I link to the http:// version of imgur in my post.

Installing davis/flarum-ext-securehttps (0.1.0-beta3)

Davis

Arie does it show an error? Can you post the url of the image that is linked? Does the image show with the extension disabled?

Arie

Davis https://i.imgur.com/u4L2AzX.jpg or rather without https: http://i.imgur.com/u4L2AzX.jpg

If I simply disable the Proxy setting, it correctly converts the http to https.

Davis

Arie The image works through my domain. https://www.produes.co/api/davis/securehttps/i.imgur.com%2Fu4L2AzX.jpg/

Do you have a valid https certificate and https enabled on your server? Do you understand what proxying entails? I have opted to change all http images to a proxied domain to decrease loading time.

Also, please answer the questions from my last post or get with me on gitter ?

Davis

0.1.0beta4 Released

Fixed:

Apache support encoded slashes
Blue color of 'show anyways' link

7h3ev1l

Is this extension protected from sqli and other hacks?

Davis

7h3ev1l the only thing this extension does is display images in https to keep the green lock on user's toolbar

7h3ev1l

Yes i see but u can put https://www.produes.co/api/davis/secure"""=<>{} etc...

Davis

7h3ev1l oh I see what you mean. The API doesn't use the database, it only file_get_contents on the file provided as displays it.

arjoni

7h3ev1l what a beautiful design your forum has. Care to explain how did you do that? Sorry for offtopic but we lack the messages and chat... ?