896148 - Theme (former Personas) preview on the customize page doesn't work via SSL

Status: RESOLVED WONTFIX

(Websites :: Other, defect, P4)

Description

[Kohei Yoshino [:kohei]]

Attachment: patch

This iframe contains postMessage where targetOrigin is restricted to "http://www.mozilla.org". Both http and https should be allowed. 
https://getpersonas.cdn.mozilla.net/en-US/external/mozilla/

The code is located at
http://svn.mozilla.org/projects/getpersonas.com/trunk/server/external/mozilla/footer.php

Comment 1

[Jennifer Bertsch [:jbertsch]]

Cmore - did we already fix this once?

Lforrest - what is the priority level for you?

Comment 2

[Chris More [:cmore]]

The persona preview was previously working, but it doesn't look like it is anymore. I wonder if the reasons that the previews don't work anymore is because addons.mozilla.org is the only whitelisted domain allowed to do so?

Comment 3

[Kohei Yoshino [:kohei]]

Hmm, even on http, the preview doesn't work... Changing the xpinstall.whitelist.add pref to addons.mozilla.org,getpersonas.cdn.mozilla.net had no effect. Moving the page to addons.mozilla.org is a possible solution? Or just removing the preview.

Comment 4

[Jennifer Bertsch [:jbertsch]]

Let's remove the preview.  Thanks, Kohei!

Comment 5

[Ben (:bensternthal)]

Removing mixed content blocker on this one. My reading of this is that the problem here is not related to http vs https and the new feature of ff.

Comment 6

[Kohei Yoshino [:kohei]]

The customize page has been redesigned, and the iframe is gone.