Hello everyone I have been working on locking down Oxwall for SSL - HTTPS and I wanted to share some findings with anyone who may wish to run Oxwall on SSL and also at the same time I have some questions to pose for answers or suggestions.

So let's start off with some SSL errors I ran into and how they got resolved:

SSL errors stemming from YouTube thumbnails. Errors occurring in the newsfeed as well as on the left side block for videos.

The Fix Part 1:

In ow_plugins/video/classes/video_providers.php simply change the following code so that the http is instead https...

private function init()
    {
        if ( !isset(self::$provArr) )
        {
            self::$provArr = array(
                self::PROVIDER_YOUTUBE => 'https://www.youtube(-nocookie)?.com/',

class VideoProviderYoutube
{
    const clipUidPattern = 'https:\/\/www\.youtube(-nocookie)?\.com\/(v|embed)\/([^?&"]+)[?&"]';
    const thumbUrlPattern = 'https://img.youtube.com/vi/()/default.jpg';

The Fix Part 2: The above code change will not correct any videos that have already been added and only fixes future video uploads. In order to go back and fix previous videos go to the database and look for ow_newsfeed_action and look also for ow_video_clip. In these two areas you will have to sift the database and modify any http image src calls to be https instead.

Now SSL errors stemming from Facebook Connect: The FB connect was creating an SSL error like this:
'http://connect.facebook.net/en_US/all.js': this content should also be loaded over HTTPS. This was also causing the Facebook connect to fail and not work when clicked in the full site and also fail in the mobile site.

The Fix Part 1:

In /ow_plugins/fbconnect/controllers/connect.php make the code change shown below by merely changing the http to https:

public function xdReceiver()
    {
        $cache_expire = 60*60*24*365;
        header("Pragma: public");
        header("Cache-Control: maxage=".$cache_expire);
        header('Expires: ' . gmdate('D, d M Y H:i:s', time()+$cache_expire) . ' GMT');

        echo '<script src="https://connect.facebook.net/en_US/all.js"></script>';

        exit();
    }

The Fix Part 2:

In community/ow_plugins/fbconnect/bol/service.php make the code change shown below by merely changing the http to https:

public function initializeJs($scope = null, $shareData = null )
    {
        if ($this->jsInitialized)
        {
            return;
        }
        $document = OW::getDocument();

        $document->addScript(OW::getPluginManager()->getPlugin('fbconnect')->getStaticJsUrl() . 'fb.js');

        $loginParams = array(
            'scope' => $this->scope
        );

        $fbLibUrl = 'https://connect.facebook.net/en_US/all.js';

        $uri = OW::getRequest()->getRequestUri();

After these changes the SSL error is gone and the button works great in the full site and the mobile site. If anything is amiss here or done wrong I would appreciate any suggestions or input.

Now there are still SSL problems in Oxwall that I have not fixed yet and I hope to get some help resolving these issues.

Problem 1: When a user adds a URL link to a post Oxwall goes to that site and grabs an image which it embeds in the post. Problem is the image URL is back to that site and when that site is not HTTPS then an SSL error ensues. What we need is for Oxwall to go and grab that image and add it into the Oxwall forum and then embed it internally under an HTTPS call. This way users can add links to no SSL sites and yet the post can display an image and still be SSL instead of hotlinking the image to an insecure site.

Problem 2: The Owall Admin page makes us of an Iframe that also has 4 insecure images as well the entire iframe link is insecure hotlinking back to http source. The 4 insecured images are: facebook_icon.png, ox-donate-btn.pong, rss_icon.png and twitter_icon.png. The insecure iframe hotlink for this block is: http://static.oxwall.org/spotlight/?platform=oxwall&platform-version=1.6.0&platform-build=7157 I am attaching an image of the block as well.

So, that's about it I have managed to fix a few things and some additional problems remain. Is it crazy to think that one day Oxwall is capable to install and run sweet on HTTP or HTTPS? I think it will happen for sure we just have to work together and implement a few changes.

Cheers to all and happy HTTPS-ing!