425729 - Links in RSS feeds use HTTP instead of HTTPS

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect)

Description

[Wladimir Palant]

From what I can see, all links in AMO's RSS feeds point to HTTP rather than HTTPS:

https://addons.mozilla.org/en-US/firefox/statistics/addon/1865/format:rss
https://addons.mozilla.org/en-US/firefox/addons/rss/newest
https://addons.mozilla.org/en-US/firefox/recommended/format:rss

Of course the server will redirect the user to HTTPS - but that leaves the user vulnerable to DNS spoofing attacks, the user won't get a warning message if http://addons.mozilla.org/ isn't the server he wanted to visit.

Comment 1

[Fred Wenzel [:wenzel]]

fligtar suggested using SITE_URL rather than CakePHP's built-in FULL_BASE_URL for this purpose as it'll always have the right site URL (including https). That's an easy enough fix so I'll do that later.

Comment 2

[Fred Wenzel [:wenzel]]

Attachment: SITE_URL for RSS feeds

Replacing all FULL_BASE_URLs with SITE_URLs (in RSS feeds only).

Comment 3

[Michael Morgan [:morgamic]]

r13061, checked it in for wenzel.

Comment 4

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; while testing found bug 433451 and bug 433453.