{"thread":{"id":"32759","subject":"[PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","startedAt":"2013-01-28T23:41:32Z","lastAt":"2013-02-01T00:58:46Z","messageCount":8,"participants":["Andrej E Baranov","Junio C Hamano","Bryan Turner","Jonathan Nieder"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"208136","messageId":"1359416492-8597-1-git-send-email-admin@andrej-andb.ru","threadId":"32759","inReplyTo":null,"subject":"[PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Andrej E Baranov","fromEmail":"admin@andrej-andb.ru","sentAt":"2013-01-28T23:41:32Z","receivedAt":"2013-01-28T23:41:32Z","isPatch":true,"sender":{"key":"admin@andrej-andb.ru","avatar":"https://gravatar.com/avatar/911e65da5a0561cab1e8ee11c2da0f495d1252ac54ba7eb474cde5a91ade07d5?d=mp&s=160"},"body":"Just drop the scheme: part from the URL, so that these\nexternal sites are accessed over https:// in such a case.\n\nSigned-off-by: Andrej E Baranov <admin@andrej-andb.ru>\n---\n gitweb/gitweb.perl | 4 ++--\n 1 file changed, 2 insertions(+), 2 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex c6bafe6..1309196 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -2068,7 +2068,7 @@ sub picon_url {\n \tif (!$avatar_cache{$email}) {\n \t\tmy ($user, $domain) = split('@', $email);\n \t\t$avatar_cache{$email} =\n-\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n+\t\t\t\"//www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n \t\t\t\"$domain/$user/\" .\n \t\t\t\"users+domains+unknown/up/single\";\n \t}\n@@ -2083,7 +2083,7 @@ sub gravatar_url {\n \tmy $email = lc shift;\n \tmy $size = shift;\n \t$avatar_cache{$email} ||=\n-\t\t\"http://www.gravatar.com/avatar/\" .\n+\t\t\"//www.gravatar.com/avatar/\" .\n \t\t\tDigest::MD5::md5_hex($email) . \"?s=\";\n \treturn $avatar_cache{$email} . $size;\n }\n-- \n1.8.1.1\n"},{"id":"208144","messageId":"7vtxq0u1v3.fsf@alter.siamese.dyndns.org","threadId":"32759","inReplyTo":"1359416492-8597-1-git-send-email-admin@andrej-andb.ru","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-29T03:03:44Z","receivedAt":"2013-01-29T03:03:44Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Thanks; will queue.\n"},{"id":"208145","messageId":"CAGyf7-GJkKDWdykq8iv90tU3TUR5ZKUf2bQc9sJokbq-RFYBYg@mail.gmail.com","threadId":"32759","inReplyTo":"7vtxq0u1v3.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Bryan Turner","fromEmail":"bturner@atlassian.com","sentAt":"2013-01-29T03:28:02Z","receivedAt":"2013-01-29T03:28:02Z","isPatch":true,"sender":{"key":"bturner@atlassian.com","avatar":"https://gravatar.com/avatar/16bcf3167981c1ef7c804e502642366d888a35b0d0b0a4ca01fdc442aa1acb1e?d=mp&s=160"},"body":"This won't work correctly as-is. The secure URL for Gravatar is\n\"https://secure.gravatar.com\"[1], not \"https://www.gravatar.com\".\n\n[1] See the \"Secure Requests\" section on:\nhttps://en.gravatar.com/site/implement/images/\n\nOn 29 January 2013 14:03, Junio C Hamano <gitster@pobox.com> wrote:\n>\n> Thanks; will queue.\n>\n>\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n"},{"id":"208146","messageId":"20130129041206.GA15442@google.com","threadId":"32759","inReplyTo":"CAGyf7-GJkKDWdykq8iv90tU3TUR5ZKUf2bQc9sJokbq-RFYBYg@mail.gmail.com","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2013-01-29T04:12:06Z","receivedAt":"2013-01-29T04:12:06Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi Bryan,\n\nBryan Turner wrote:\n\n> This won't work correctly as-is. The secure URL for Gravatar is\n> \"https://secure.gravatar.com\"[1], not \"https://www.gravatar.com\".\n\nOdd.  \"https://www.gravatar.com/\" also seems to work.  I've put in a\ntechnical support query to find out what the Gravatar admins prefer.\n\nThanks,\nJonathan\n"},{"id":"208147","messageId":"CAGyf7-Gub7pFY+NpX0Cp4p9bUyzZHfp6qj+b5uNOEgHfhSJykw@mail.gmail.com","threadId":"32759","inReplyTo":"20130129041206.GA15442@google.com","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Bryan Turner","fromEmail":"bturner@atlassian.com","sentAt":"2013-01-29T04:16:22Z","receivedAt":"2013-01-29T04:16:22Z","isPatch":true,"sender":{"key":"bturner@atlassian.com","avatar":"https://gravatar.com/avatar/16bcf3167981c1ef7c804e502642366d888a35b0d0b0a4ca01fdc442aa1acb1e?d=mp&s=160"},"body":"Interesting. I wonder if they've changed it recently. I only pointed\nit out because a software product I'm working on had a bug because it\nwas building the URLs with \"https://www...\" and the resulting images\nwere showing as X's instead of avatars. We had to change the\nimplementation to use \"https://secure...\" to get the avatars to load\ncorrectly. That's been ~8 months ago now, though, so maybe it's no\nlonger the case. It seems like it would be much more convenient if\nthey just changed the scheme.\n\nBryan\n\nOn 29 January 2013 15:12, Jonathan Nieder <jrnieder@gmail.com> wrote:\n> Hi Bryan,\n>\n> Bryan Turner wrote:\n>\n>> This won't work correctly as-is. The secure URL for Gravatar is\n>> \"https://secure.gravatar.com\"[1], not \"https://www.gravatar.com\".\n>\n> Odd.  \"https://www.gravatar.com/\" also seems to work.  I've put in a\n> technical support query to find out what the Gravatar admins prefer.\n>\n> Thanks,\n> Jonathan\n"},{"id":"208203","messageId":"7va9rrq1o3.fsf@alter.siamese.dyndns.org","threadId":"32759","inReplyTo":"20130129041206.GA15442@google.com","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-01-29T18:33:48Z","receivedAt":"2013-01-29T18:33:48Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jonathan Nieder <jrnieder@gmail.com> writes:\n\n> Odd.  \"https://www.gravatar.com/\" also seems to work.  I've put in a\n> technical support query to find out what the Gravatar admins prefer.\n\nThanks; will hold onto Andrej's patch until we hear what the story\nis.\n\nOf course we could do something like this (untested).\n\n gitweb/gitweb.perl | 24 +++++++++++++++++++-----\n 1 file changed, 19 insertions(+), 5 deletions(-)\n\ndiff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl\nindex c6bafe6..b59773b 100755\n--- a/gitweb/gitweb.perl\n+++ b/gitweb/gitweb.perl\n@@ -313,6 +313,14 @@ sub evaluate_uri {\n \t\t'override' => 0,\n \t\t'default' => [0]},\n \n+\t# Use https:// URL for embedded picons/gravatar images, to be used\n+\t# on installations that server gitweb over https://\n+\t'subcontentssl' => {\n+\t\t'sub' => sub { feature_bool('subcontentssl', @_) },\n+\t\t'override' => 0,\n+\t\t'default' => [0]},\n+\t}\n+\n \t# Enable the 'snapshot' link, providing a compressed archive of any\n \t# tree. This can potentially generate high traffic if you have large\n \t# project.\n@@ -1111,6 +1119,7 @@ sub evaluate_git_dir {\n }\n \n our (@snapshot_fmts, $git_avatar);\n+our ($gravatar_base_url, $picon_base_url);\n sub configure_gitweb_features {\n \t# list of supported snapshot formats\n \tour @snapshot_fmts = gitweb_get_feature('snapshot');\n@@ -1121,10 +1130,17 @@ sub configure_gitweb_features {\n \t# if the provider name is invalid or the dependencies are not met,\n \t# reset $git_avatar to the empty string.\n \tour ($git_avatar) = gitweb_get_feature('avatar');\n+\tmy $use_https = gitweb_check_feature('subcontentssl');\n+\n \tif ($git_avatar eq 'gravatar') {\n \t\t$git_avatar = '' unless (eval { require Digest::MD5; 1; });\n+\t\t$gravatar_base_url = $use_https ?\n+\t\t    \"https://secure.gravatar.com/avatar/\" :\n+\t\t    \"http://www.gravatar.com/avatar/\";\n \t} elsif ($git_avatar eq 'picon') {\n-\t\t# no dependencies\n+\t\t$picon_base_url = $use_https ?\n+\t\t    \"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" :\n+\t\t    \"https://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\";\n \t} else {\n \t\t$git_avatar = '';\n \t}\n@@ -2068,7 +2084,7 @@ sub picon_url {\n \tif (!$avatar_cache{$email}) {\n \t\tmy ($user, $domain) = split('@', $email);\n \t\t$avatar_cache{$email} =\n-\t\t\t\"http://www.cs.indiana.edu/cgi-pub/kinzler/piconsearch.cgi/\" .\n+\t\t\t$picon_base_url .\n \t\t\t\"$domain/$user/\" .\n \t\t\t\"users+domains+unknown/up/single\";\n \t}\n@@ -2082,9 +2098,7 @@ sub picon_url {\n sub gravatar_url {\n \tmy $email = lc shift;\n \tmy $size = shift;\n-\t$avatar_cache{$email} ||=\n-\t\t\"http://www.gravatar.com/avatar/\" .\n-\t\t\tDigest::MD5::md5_hex($email) . \"?s=\";\n+\t$avatar_cache{$email} ||= $gravatar_base_url . Digest::MD5::md5_hex($email) . \"?s=\";\n \treturn $avatar_cache{$email} . $size;\n }\n \n"},{"id":"208324","messageId":"20130131012853.GD15680@google.com","threadId":"32759","inReplyTo":"7va9rrq1o3.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2013-01-31T01:28:53Z","receivedAt":"2013-01-31T01:28:53Z","isPatch":true,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Junio C Hamano wrote:\n> Jonathan Nieder <jrnieder@gmail.com> writes:\n\n>> Odd.  \"https://www.gravatar.com/\" also seems to work.  I've put in a\n>> technical support query to find out what the Gravatar admins prefer.\n>\n> Thanks; will hold onto Andrej's patch until we hear what the story\n> is.\n\nGood news: a kind person from Automattic answered that\nwww.gravatar.com should work fine over SSL, both now and in the\nfuture, and promised to add updating documentation to their todo list.\n\nThanks for your help and patience.\nJonathan\n"},{"id":"208433","messageId":"7vvcacdf3t.fsf@alter.siamese.dyndns.org","threadId":"32759","inReplyTo":"20130131012853.GD15680@google.com","subject":"Re: [PATCH] The images from picon and gravatar are always used over http://, and browsers give mixed contents warning when gitweb is served over https://.","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2013-02-01T00:58:46Z","receivedAt":"2013-02-01T00:58:46Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jonathan Nieder <jrnieder@gmail.com> writes:\n\n> Junio C Hamano wrote:\n>> Jonathan Nieder <jrnieder@gmail.com> writes:\n>\n>>> Odd.  \"https://www.gravatar.com/\" also seems to work.  I've put in a\n>>> technical support query to find out what the Gravatar admins prefer.\n>>\n>> Thanks; will hold onto Andrej's patch until we hear what the story\n>> is.\n>\n> Good news: a kind person from Automattic answered that\n> www.gravatar.com should work fine over SSL, both now and in the\n> future, and promised to add updating documentation to their todo list.\n>\n> Thanks for your help and patience.\n\nI'll merge Andrej's topic to 'next' in the next integration cycle.\nThe fix should hit 'master' no later than the beginning of next\nweek.\n\nThanks.\n"}]}