254684 - Quick search redirects from https: to http:

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[[e-mail]]

If you quick search then the search results are always insecure.

Comment 1

[[e-mail]]

Or would it be better to send this bug to mozilla.org webtools to get them to
change localconfig.js to read var bugzilla = "/"; or something?

Comment 2

[Joel Peshkin]

Actually, I'm sure this will be marked a dupe of something on its arrival, but
bmo   is waiting for its certificates before changing urlbase.

Comment 3

[Dave Miller [:justdave]]

Yeah, this will automatically happen when we switch everything over to point at
https, which isn't happening until we have the real certs.

*** This bug has been marked as a duplicate of 58300 ***

Comment 4

[[e-mail]]

OK, but is there a reason Bugzilla uses absolute URLs here?

Comment 5

[Dave Miller [:justdave]]

no, there isn't...

Comment 6

[Dave Miller [:justdave]]

baseurl for quicksearch is now "/" and it seems to work for me.

Comment 7

[[e-mail]]

Thanks!

Comment 8

[Dave Miller [:justdave]]

Bah, I knew there was a reason it had an absolute URL.

Comment 9

[Dave Miller [:justdave]]

There are external sites that link to that javascript file, and setting the
urlbase to "/" broke those sites.  I've changed it back to the http: url.  It'll
get changed to https: after the Thawte cert is in place (hopefully a couple days).

Comment 10

[Jesse Ruderman]

I don't want to get redirected from http to https in QuickSearch unless I'm
redirected from http to https everywhere.  Can you make
https://bugzilla.mozilla.org/localconfig.js different from
http://bugzilla.mozilla.org/localconfig.js?

Comment 11

[Dave Miller [:justdave]]

(In reply to comment #10)
> I don't want to get redirected from http to https in QuickSearch unless I'm
> redirected from http to https everywhere.  Can you make
> https://bugzilla.mozilla.org/localconfig.js different from
> http://bugzilla.mozilla.org/localconfig.js?

Hmm, now that you mention it, yes, that's quite doable.   Done. :)

We now have a second copy of localconfig.js at localconfig-https.js.  The SSL
version of the virtual host for Bugzilla now has a rewrite rule that points
references to localconfig.js at the https version.

This little hack can go away once we're forcing everyone to https anyway.