729605 - Mixed scripting on https://wiki.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: WebOps: Other, task)

Description

[David Benjamin]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.33 Safari/535.19

Steps to reproduce:

Visit https://wiki.mozilla.org/


Actual results:

In Chrome's beta channel release, there are scripts and stylesheets that are blocked. The offending URLs are

http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/themes/base/jquery-ui.css
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/themes/smoothness/jquery-ui.css
http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.14/jquery-ui.min.js


Expected results:

Those resources should be fetched over HTTPS.

Comment 1

[Reed Loden [:reed]]

Indeed, over to IT. Not sure why we're including external stylesheets in the first place. We should host those locally.

Comment 2

[Jake Maul [:jakem]]

This is caused by the recent addition of the Mediawiki-Bugzilla extension. Assigning to the maintainer of this extension...

Brandon, can you make these protocol-relative, and/or locally included in your git repo? Let me know when one or the other is done (and what the repo is again, so I can re-clone) and I can push out the fix.

I have a mild preference to locally-hosting these files as well, simply to remove a dependency on a 3rd-party service. For what its worth, Semantic MediaWiki and Semantic Forms both locally-host some jquery files as well, so there's some precedence within wikimo for doing it this way.

Comment 4

[Mike Kaply [:mkaply]]

For the record, this is a much bigger problem on non Firefox browsers. On Firefox, people turn off the warning and never see it. On chrome, you get the message on every page.

A quick fix would be just to make those two links relative. Google provides https versions of the files.

Comment 5

[Mike Kaply [:mkaply]]

This is really annoying and is a quite easy fix. Is there a reason it's not being fixed?

Comment 6

[Brandon Savage [:brandon]]

Because it was assigned to me while I was asleep last night and I've been in meetings all day. Patches encouraged: https://github.com/mozilla/mediawiki-bugzilla I'll be on vacation until Wednesday.

Comment 7

[Mike Kaply [:mkaply]]

Sleep is for the weak! :)

I'll take a look.

Comment 8

[Lawrence Mandel [:lmandel] (use needinfo)]

I have a fix ready. Just need to ensure that my copy of the repo is in sync with the above and issue the pull request. My fix bundles the jquery and jquery ui packages in the mediawiki-buzilla package so that everything is local. Here's my copy:

https://github.com/lmandel/mediawiki-bugzilla

Comment 9

[Lawrence Mandel [:lmandel] (use needinfo)]

My copy was woefully out of date. Now that it's back in sync I have issued a pull request for Brandon to review and grab the changes.

Comment 10

[Brandon Savage [:brandon]]

This has been merged to master.

Comment 11

[Jake Maul [:jakem]]

This patch is no good... It results in the page requesting things like this:

https://wiki.allizom.org/$wgScriptPath/extensions/Bugzilla/web/jqueryui/1.8.14/jquery-ui.min.js

$wgScriptPath is being passed directly, not interpreted.


Compare:

Bugzilla.php:    $out->addScript('<script type="text/javascript" src="$wgScriptPath/extensions/Bugzilla/web/jqueryui/1.8.14/jquery-ui.min.js"></script>');

vs. this line found elsewhere in the same file:

Bugzilla.php:    $out->addScriptFile("$wgScriptPath/extensions/Bugzilla/web/js/jquery.dataTables.js" );


The latter works properly... the former results in a literal copy of the string into the HTML.

Comment 12

[Lawrence Mandel [:lmandel] (use needinfo)]

Interesting that this worked on my test system. I have made the changes as you suggested above. Testing shows that all is functional. I have initiated a pull request to the mozilla repo.

Comment 13

[Aaron]

I'm not sure what netops can do to help here...  Assigning back to original owner unless there's an action item for us.

Comment 14

[Brandon Burton [:solarce]]

If the pull request mentioned in https://bugzilla.mozilla.org/show_bug.cgi?id=729605#c12 has been merged into master, I can work with :jakem to push this to stage and make sure it's working. 

Let us know, feel free to ping me on irc too

Comment 15

[Lawrence Mandel [:lmandel] (use needinfo)]

Yup. The request has been merged into master along with fixes for two other bugs. See bug 733389 for a deployment request for the three fixes.

Comment 16

[Jake Maul [:jakem]]

The fix is pushed live... this seems resolved.