160712 - SSL encrypted web pages ignore some stylesheets with images

Status: VERIFIED INVALID

(Core :: Security, defect)

Description

[Daniel Amor]

We are building a rather complex web site based on style sheets, which works
fine on HTTP, but now I switched on HTTPS for login and suddenly the following
command does not work anymore in Mozilla 1.0, 1.1b. 

<style type="text/css">
<!--
BODY { background:#FFFFFF url(/portal/common/header_back.jpg) repeat-x }
//-->

</STYLE>

The image is not shown. It works perfectly in MSIE 5.5 and MSIE 6.0 both
encrypted and unencrypted, and in Mozilla only when unencrypted. 

You can load the image manually on the HTTPS-server via
http://domain.xx/portal/common/header_back.jpg, so it does not seem to be a
misconfiguration of Apache.

All other style-sheets that are applied to the page are ok, as long as they do
not require an image to be loaded.

Any idea?

Danny

Comment 1

[Daniel Amor]

I meant https://domain.xx, not http://domain.xx... sorry for the typo. 

Comment 2

[Alfonso Martinez]

Can you setup a minimal page to test the problem?
Thank you.

Comment 3

[Daniel Amor]

Found the bug, it was Apache or Proxy, it was caching some old files.

Sorry for the inconvience.

Danny

Comment 4

[Wesha]

verified invalid

Reason: original reporter's Comment 4