544428 - Mixed-content SSL warning on pages due to iframe

Status: RESOLVED FIXED

(www.mozilla.org :: General, defect)

Description

[Reed Loden [:reed]]

If I visit the firstrun page over HTTPS, I get a mixed content SSL warning (broken lock). This is due to the iframe:

        <iframe
            src="http://www.getpersonas.com/en-US/external/mozilla/firstrun.php"
            width="320"
            height="200">
            </iframe>

Should check to see if page is being accessed over HTTPS and use https://www.getpersonas.com instead.

However, it seems https://www.getpersonas.com/en-US/external/mozilla/firstrun.php redirects to http://, so I'll have to get that fixed, too. Sigh.

Comment 1

[Ryan Doherty (:rdoherty)]

Where/how are we linking to the firstrun page over ssl?

Comment 2

[Reed Loden [:reed]]

(In reply to comment #1)
> Where/how are we linking to the firstrun page over ssl?

We aren't linking to it anywhere, as far as I know, but we still should support those people who wish to access the page via SSL, especially since it's not a hard thing to do. This will become especially important in the future if/when the entire site is behind SSL, as has been discussed in some groups lately.

Comment 3

[John Slater]

Alex, can you check this out?

Comment 4

[Alex Buchanan [:abuchanan]]

changes done on trunk in r62056

This is blocked on HTTPS support for getpersonas.com

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #4)
> changes done on trunk in r62056
> 
> This is blocked on HTTPS support for getpersonas.com

What's the bug for that?

Comment 6

[Alex Buchanan [:abuchanan]]

/me points at the Depends On: field

Comment 7

[Stephen Donner [:stephend] Not actively reading bugmail]

(In reply to comment #6)
> /me points at the Depends On: field

...which doesn't have a great summary, since it appears to only talk about firstrun; my bad.

Comment 8

[Reed Loden [:reed]]

(In reply to comment #4)
> changes done on trunk in r62056

Looks like these pages need it fixed, too:
* en-US/firefox/3.6/whatsnew/index.html
* en-US/firefox/students/panel.inc.php
* en-US/firefox/customize/index.html (imgs)
* en-US/firefox/3.6/firstrun/a/index.html (imgs)
* en-US/firefox/3.6/firstrun/b/index.html (imgs)
* en-US/firefox/3.6/firstrun/c/index.html (imgs)
* en-US/firefox/personal.html (imgs)

Comment 9

[Alex Buchanan [:abuchanan]]

Attachment: patch, remove http: and <?= $config['url_scheme'] ?>: from www.getpersonas URLs

This is a big patch and affects 128 files

This patch removes http: and <?= $config['url_scheme'] ?>: from www.getpersonas URLs

Comment 10

[Alex Buchanan [:abuchanan]]

(In reply to comment #8)
> Looks like these pages need it fixed, too:
> * en-US/firefox/3.6/whatsnew/index.html
> * en-US/firefox/students/panel.inc.php
> * en-US/firefox/customize/index.html (imgs)

covered by patch


> * en-US/firefox/3.6/firstrun/a/index.html (imgs)
> * en-US/firefox/3.6/firstrun/b/index.html (imgs)
> * en-US/firefox/3.6/firstrun/c/index.html (imgs)

These are old A/B tests that need to be deleted, https://bugzilla.mozilla.org/show_bug.cgi?id=565408#c9


> * en-US/firefox/personal.html (imgs)

This page doesn't exist, it gets redirected to /en-US/firefox/.  The file should be deleted.  https://bugzilla.mozilla.org/show_bug.cgi?id=548357#c10