Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Bug with SSL Offloading

Description

there seem to be an issue in UrlUtils.cs, according to
http://www.dnnsoftware.com/forums/forumid/198/threadid/495676/scope/posts, please see Forum post for details.

This function here:
https://github.com/dnnsoftware/Dnn.Platform/blob/012dcf82ea23ebfa2f8484f369b0d15f3c5f7590/DNN%20Platform/Library/Common/Utilities/UrlUtils.cs#L220

It does not honor the SSL offloading header. It should check for this instead of just returning the link in the same url as it's delivered.

Steps to reproduce:

Setup your site with SSL offloading. Links to Edit Content (any popup) will open in http://. This is fine, except if you're serving SSL content it violates the same origin policy (iframe on same domain is blocked if the protocol is different.) This results in a blank popup.

[blocked] The page at 'https://www.harboria.com/' was loaded over HTTPS, but ran insecure content from 'http://www.harboria.com/home/ctl/edit...': this content should also be loaded over HTTPS.

An example of the proper way to do this is in the DNN source code here:

https://github.com/dnnsoftware/Dnn.Platform/blob/012dcf82ea23ebfa2f8484f369b0d15f3c5f7590/DNN%20Platform/Modules/Journal/Components/JournalParser.cs#L55

QA Test Plan

None

Attachments

2

Activity

Show:

Bing Wu August 28, 2015 at 10:36 PM

Issue closed per Cathal's investigation. This issue is quite old, problem probably fixed indirectly already.

cathal connolly August 26, 2015 at 2:12 PM

attached is a fiddler capture file that shows loading "securepage" (see image for confirmation it's an ssl-offloaded page), going into edit mode, then clicking "edit content", editing the content and finally clicking update, causing the page to reload. All actions happen in HTTPS as expected.

cathal connolly April 21, 2015 at 7:22 PM

I believe this is a duplicate of dnn-6886 -however I'm keeping it open so it can be verified when we work on that issue in 7.4.2

Cannot Reproduce

Details

Assignee

Reporter

Severity

Major

Triage

New

Includes Code Fix

No

Documentation Required

No

Components

Sprint

Fix versions

Affects versions

Priority

Created January 23, 2014 at 7:55 AM
Updated August 28, 2015 at 10:36 PM
Resolved August 26, 2015 at 2:12 PM