<inp2:m_TemplatesBase /> and SSL

[Chris Walker]

My admin is under SSL, and as such when I try to edit a content my page is not loaded correctly because the <inp2:m_TemplatesBase /> tag  I'm using to load the css and images is not accessing the content via SSL:

<link rel='stylesheet' type='text/css' media='all' href="<inp2:m_TemplatesBase />inc/css/navbar.css" />

generates a non-ssl fully qualified URL when loaded inside the admin.  If I view the SSL-enabled pages on the front end, it does use https.  More I look at it, the more I think that if the admin panel is used via SSL, so should the content management (provided the html uses tags to build urls)

Is there a work around for this, or a better way to do this?

Thanks!
Chris

--
You received this message because you are subscribed to the Google Groups "In-Portal Bugs Team" group.
To post to this group, send email to in-port...@googlegroups.com.
To unsubscribe from this group, send email to in-portal-bug...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/in-portal-bugs?hl=en.

[Alexander Obuhovich]

I've tried on 5.0.4-B1 (in SVN) and I'm pretty sure, that will work the same on 5.0.3 version. Here what I've found:

• Mine "SSL Full URL for Administrative Console (https://www.domain.com/path)" variable is set
• Mine "Require SSL for Administrative Console" is also set
• everything else if same as for default installation

I've found, that we have broken lock sign, since all background images in administrative console are loaded via http://. That's a bug, but can be avoided by opening "Default" skin in "Tools -> Admin Skins" section - just open it and save it. Then press F5 to refresh whole administrative console.

Then I go to "Browse Site" and switch whatever content mode I need. I made "View Source" and all links to CSS files are in https://.

When I visit a site not from administrative console, then all links to CSS are in http://.


It really uses SSL setting from admin, when viewing front-end from admin. I've programmed it a long ago.

--
Best Regards,

http://www.in-portal.com
http://www.alex-time.com

[Chris Walker]

hmm, here's what I did:
- verified the 2 settings below.  My admin console SSL path is https://www.sunnysidekick.com/admin/

and the Requre SSL for admin console is checked.  (in fact, everything in the SSL section is checked)

If I view the source (even after clearing the cache, logout, etc) the source of the admin frame to browse the site contains:

<!-- JS FOR ADMIN -->
<link rel="stylesheet" href="http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/thickbox.css" type="text/css" media="screen"/>

<link rel="stylesheet" href="http://www.sunnysidekick.com/core/admin_templates/js/../incs/cms.css" type="text/css" media="screen"/>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/jquery.pack.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/jquery-ui.custom.min.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/is.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/application.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/script.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/thickbox.js"></script>

<script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/template_manager.js"></script>

<script language="javascript">
TB.pathToImage = 'http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/loadingAnimation.gif';

var aTemplateManager = new TemplateManager('http://www.sunnysidekick.com/admin/index.php?env=-themes/template_edit:m0-1-1-4-d-:theme%5C-file---#EVENT#&block=#BLOCK#&theme_id=4&source=index&front=1&admin=1&editing_mode=1', 'http://www.sunnysidekick.com/index.php?env=-index:m0-1-1-4-s-&editing_mode=#EDITING_MODE#&admin=1', 'http://www.sunnysidekick.com/index.php?env=-index:m0-1-1-4-s-:theme%5C-file---OnSaveLayout&source=index&admin=1&editing_mode=1', 1);

var main_title = 'SunnySideKick';
var $use_popups = true;
var $modal_windows = true;

</script>

It's more than a broken lock issue, FF won't execute the javascript..  So the page's jquery isn't executed, and the edit mode links at the top are missing..

[Alexander Obuhovich]

I see now. You have added "/admin" at the end of your ssl path in configuration:
replace "https://www.sunnysidekick.com/admin/" with "https://www.sunnysidekick.com".

Also no trailing slashes at the end (as in example on configuration page)!

[Chris Walker]

I had it that way at one point, I put it like that (so both URLs are https://www.sunnysidekick.com) and it didn't change anything.. Browse still doesn't work..  I did confirm that if I drop the require SSL then everything works as expected.. 

So still facing the same problem, but thanks for your help so far!

[Alexander Obuhovich]

Let's ask if Dmitry/Phil can replicate this one.

[Chris Walker]

Dmitry - feel free to log into my site and experiment if you'd like

[Dmitry Andrejev]

Hi guys,

Reviewed and tested in Chris's site and In-Portal 5.1.0-B1 - both have the same issue described by the Chris.

Alex, make sure you look at the source of the right frame - I do confirm that all CSS and JSS and other urls that are build using TemplateBase have this issue.

DA.

[Dmitry A.]

New task has been filed:

762: Issues with "TemplatesBase" tag and SSL

http://tracker.in-portal.org/view.php?id=762

DA.

On May 30, 6:34 pm, Dmitry Andrejev <dandre...@gmail.com> wrote:
> Hi guys,
>
> Reviewed and tested in Chris's site and In-Portal 5.1.0-B1 - both have the
> same issue described by the Chris.
>
> Alex, make sure you look at the source of the right frame - I do confirm
> that all CSS and JSS and other urls that are build using TemplateBase have
> this issue.
>
> DA.
>
>
>
> On Mon, May 24, 2010 at 2:37 PM, Chris Walker <deno...@gmail.com> wrote:
> > Dmitry - feel free to log into my site and experiment if you'd like
>

> > On Mon, May 24, 2010 at 1:42 PM, Alexander Obuhovich <aik.b...@gmail.com>wrote:
>
> >> Let's ask if Dmitry/Phil can replicate this one.
>

> >> On Mon, May 24, 2010 at 8:32 PM, Chris Walker <deno...@gmail.com> wrote:
>
> >>> I had it that way at one point, I put it like that (so both URLs are
> >>>https://www.sunnysidekick.com) and it didn't change anything.. Browse
> >>> still doesn't work..  I did confirm that if I drop the require SSL then
> >>> everything works as expected..
>
> >>> So still facing the same problem, but thanks for your help so far!
>
> >>> On Mon, May 24, 2010 at 11:39 AM, Alexander Obuhovich <
> >>> aik.b...@gmail.com> wrote:
>
> >>>> I see now. You have added "/admin" at the end of your ssl path in
> >>>> configuration:
> >>>> replace "https://www.sunnysidekick.com/admin/" with "
> >>>>https://www.sunnysidekick.com".
>
> >>>> Also no trailing slashes at the end (as in example on configuration
> >>>> page)!
>

> >>>> On Mon, May 24, 2010 at 6:22 PM, Chris Walker <deno...@gmail.com>wrote:
>
> >>>>> hmm, here's what I did:
> >>>>> - verified the 2 settings below.  My admin console SSL path is
> >>>>>https://www.sunnysidekick.com/admin/
>
> >>>>> and the Requre SSL for admin console is checked.  (in fact, everything
> >>>>> in the SSL section is checked)
>
> >>>>> If I view the source (even after clearing the cache, logout, etc) the
> >>>>> source of the admin frame to browse the site contains:
>
> >>>>> <!-- JS FOR ADMIN -->

> >>>>> <link rel="stylesheet" href="http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/..." type="text/css" media="screen"/>

>
> >>>>> <link rel="stylesheet" href="http://www.sunnysidekick.com/core/admin_templates/js/../incs/cms.css" type="text/css" media="screen"/>
>

> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/jquery.pa..."></script>
>
> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/jquery-ui..."></script>

>
> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/is.js"></script>
>
> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/application.js"></script>
>
> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/script.js"></script>
>

> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/..."></script>

>
> >>>>> <script type="text/javascript" src="http://www.sunnysidekick.com/core/admin_templates/js/template_manager.js"></script>
>
> >>>>> <script language="javascript">

> >>>>> TB.pathToImage = 'http://www.sunnysidekick.com/core/admin_templates/js/jquery/thickbox/...
>
> >>>>> var aTemplateManager = new TemplateManager('http://www.sunnysidekick.com/admin/index.php?env=-themes/template_edi..., 'http://www.sunnysidekick.com/index.php?env=-index:m0-1-1-4-s-&editing...<http://www.sunnysidekick.com/index.php?env=-index:m0-1-1-4-s-&editing...>', 'http://www.sunnysidekick.com/index.php?env=-index:m0-1-1-4-s-:theme%5..., 1);

>
> >>>>> var main_title = 'SunnySideKick';
> >>>>> var $use_popups = true;
> >>>>> var $modal_windows = true;
>
> >>>>> </script>
>
> >>>>> It's more than a broken lock issue, FF won't execute the javascript..
> >>>>> So the page's jquery isn't executed, and the edit mode links at the top are
> >>>>> missing..
>
> >>>>> On Sat, May 22, 2010 at 2:53 PM, Alexander Obuhovich <
> >>>>> aik.b...@gmail.com> wrote:
>
> >>>>>> I've tried on 5.0.4-B1 (in SVN) and I'm pretty sure, that will work
> >>>>>> the same on 5.0.3 version. Here what I've found:
>

> >>>>>>    - Mine "SSL Full URL for Administrative Console (

> >>>>>>    https://www.domain.com/path)" variable is set

> >>>>>>    - Mine "Require SSL for Administrative Console" is also set
> >>>>>>    - everything else if same as for default installation

>
> >>>>>> I've found, that we have broken lock sign, since all background images
> >>>>>> in administrative console are loaded via http://. That's a bug, but
> >>>>>> can be avoided by opening "Default" skin in "Tools -> Admin Skins" section -
> >>>>>> just open it and save it. Then press F5 to refresh whole administrative
> >>>>>> console.
>
> >>>>>> Then I go to "Browse Site" and switch whatever content mode I need. I
> >>>>>> made "View Source" and all links to CSS files are in https://.
>
> >>>>>> When I visit a site not from administrative console, then all links to
> >>>>>> CSS are in http://.
>
> >>>>>> It really uses SSL setting from admin, when viewing front-end from
> >>>>>> admin. I've programmed it a long ago.
>

> >>>>>> On Sat, May 22, 2010 at 8:52 PM, Chris Walker <deno...@gmail.com>wrote:
>
> >>>>>>> My admin is under SSL, and as such when I try to edit a content my
> >>>>>>> page is not loaded correctly because the <inp2:m_TemplatesBase /> tag  I'm
> >>>>>>> using to load the css and images is not accessing the content via SSL:
>
> >>>>>>> <link rel='stylesheet' type='text/css' media='all'
> >>>>>>> href="<inp2:m_TemplatesBase />inc/css/navbar.css" />
>
> >>>>>>> generates a non-ssl fully qualified URL when loaded inside the
> >>>>>>> admin.  If I view the SSL-enabled pages on the front end, it does use
> >>>>>>> https.  More I look at it, the more I think that if the admin panel is used
> >>>>>>> via SSL, so should the content management (provided the html uses tags to
> >>>>>>> build urls)
>
> >>>>>>> Is there a work around for this, or a better way to do this?
>
> >>>>>>> Thanks!
> >>>>>>> Chris
>
> >>>>>>> --
> >>>>>>> You received this message because you are subscribed to the Google
> >>>>>>> Groups "In-Portal Bugs Team" group.
> >>>>>>> To post to this group, send email to in-port...@googlegroups.com
> >>>>>>> .
> >>>>>>> To unsubscribe from this group, send email to

> >>>>>>> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >>>>>>> .

> >>>>>>> For more options, visit this group at
> >>>>>>>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >>>>>> --
> >>>>>> Best Regards,
>
> >>>>>>http://www.in-portal.com
> >>>>>>http://www.alex-time.com
>
> >>>>>> --
> >>>>>> You received this message because you are subscribed to the Google
> >>>>>> Groups "In-Portal Bugs Team" group.
> >>>>>> To post to this group, send email to in-port...@googlegroups.com.
> >>>>>> To unsubscribe from this group, send email to

> >>>>>> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >>>>>> .

> >>>>>> For more options, visit this group at
> >>>>>>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >>>>>  --
> >>>>> You received this message because you are subscribed to the Google
> >>>>> Groups "In-Portal Bugs Team" group.
> >>>>> To post to this group, send email to in-port...@googlegroups.com.
> >>>>> To unsubscribe from this group, send email to

> >>>>> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >>>>> .

> >>>>> For more options, visit this group at
> >>>>>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >>>> --
> >>>> Best Regards,
>
> >>>>http://www.in-portal.com
> >>>>http://www.alex-time.com
>
> >>>> --
> >>>> You received this message because you are subscribed to the Google
> >>>> Groups "In-Portal Bugs Team" group.
> >>>> To post to this group, send email to in-port...@googlegroups.com.
> >>>> To unsubscribe from this group, send email to

> >>>> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >>>> .

> >>>> For more options, visit this group at
> >>>>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >>>  --
> >>> You received this message because you are subscribed to the Google Groups
> >>> "In-Portal Bugs Team" group.
> >>> To post to this group, send email to in-port...@googlegroups.com.
> >>> To unsubscribe from this group, send email to

> >>> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >>> .

> >>> For more options, visit this group at
> >>>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >> --
> >> Best Regards,
>
> >>http://www.in-portal.com
> >>http://www.alex-time.com
>
> >> --
> >> You received this message because you are subscribed to the Google Groups
> >> "In-Portal Bugs Team" group.
> >> To post to this group, send email to in-port...@googlegroups.com.
> >> To unsubscribe from this group, send email to

> >> in-portal-bug...@googlegroups.com<in-portal-bugs%2Bunsubscribe@go oglegroups.com>
> >> .

> >> For more options, visit this group at
> >>http://groups.google.com/group/in-portal-bugs?hl=en.
>
> >  --
> > You received this message because you are subscribed to the Google Groups
> > "In-Portal Bugs Team" group.
> > To post to this group, send
>

> ...
>
> read more »

[Alexander Obuhovich]

Now I was able to reproduce it.

I've used highlighted settings in the attached image.

Problem was actually with "Redirect to HTTP when HTTPS isn't required" settings. That setting redirected front-end from https to http and broke down all page editing.

I wasn't able to reproduce it at first since we need to both admin and front-end ssl enable for that option to kick in.

To unsubscribe from this group, send email to in-portal-bug...@googlegroups.com.

For more options, visit this group at http://groups.google.com/group/in-portal-bugs?hl=en.

[Dmitry A.]

Hi Alex,


The patch successfully tested. (see the task) and will available in
5.0.4 and 5.1.0 of course.


DA.

> ...
>
> read more »
>
>  ssl_front_end_problem.png
> 14KViewDownload