Video
After the update I noticed there were still mistakes somewhere within the code allowing for mixed content spite http now working and being switched to https via youtube embed codes. this issue is reguarding the thumbnails and correcting their http to https.
if you open video_providers.php you will notice they left the thumbnails as http this will cause you SSL issues if you wish to be rid of this just change http to https on line 129.
Change
const thumbUrlPattern = 'http://img.youtube.com/vi/()/default.jpg';
With this
const thumbUrlPattern = 'https://img.youtube.com/vi/()/default.jpg';
NOTES:
This will only take effect on "NEW" videos not pre-existing.
I only tested this with youtube embed codes continue at your own risk if you change google video, facebook etc. All SSL findings by me will be via Oxwall plugins not 3rd party plug-ins if you want more help regarding these contact their developers.
I will be digging deeper to see what other SSL changes that could be made to help everyone secure their content. Oxwall states they don't disclose any information where changes can be made for these modification or support help towards SSL which is of course within their right. Bugs are bugs and mistakes are mistakes so use this thread as a debug finder not to complain about Oxwall and help all Oxwall members to secure their content.
Feel free to help Oxwall users out by posting your own SSL changes and please Oxwall Admins this is "Bug reports and troubleshooting" so please don't move this to "Custom Code Modification".
We build. You grow.
Get best community software hereStart a social network, a fan-site, an education project with oxwall - free opensource community software
Oxwall Troubleshooting SSL fixes | Forum
Kenneth
Nov 25 '14
Blog
If you are seeing mix content in your blogs how to fix this is simple and sort of silly.
Open a blog post that is showing mixed content click the edit button and then click save (not draft) this will turn all your site hosted images https.
Why? my guess is that after moving to SSL the links will stay http until you open the editor which auto corrects them to https.
NOTE:
This only works onto uploaded photos through oxwall. external photos need manual editing to https or upload them to your oxwall site
If you are seeing mix content in your blogs how to fix this is simple and sort of silly.
Open a blog post that is showing mixed content click the edit button and then click save (not draft) this will turn all your site hosted images https.
Why? my guess is that after moving to SSL the links will stay http until you open the editor which auto corrects them to https.
NOTE:
This only works onto uploaded photos through oxwall. external photos need manual editing to https or upload them to your oxwall site
The Forum post is edited by Kenneth Nov 25 '14
Kenneth
Nov 25 '14
Groups
This is the same issue as blogs when you have groups that show mixed content and it appears to only be the groups logo just edit the group and click save this should overwrite your previous http and turn it into https.
It's a lot of work but someone have to do it :P
NOTE:
If you have a group wall or third party content causing mixed content try to remember that this needs to be dealt with by you and the developer of the plug-in. If it's inside the wall it is most likely content from external sources that a member has posted from a http site. You can either delete this or just let it disappear as the wall feed gets newer posts.
This is the same issue as blogs when you have groups that show mixed content and it appears to only be the groups logo just edit the group and click save this should overwrite your previous http and turn it into https.
It's a lot of work but someone have to do it :P
NOTE:
If you have a group wall or third party content causing mixed content try to remember that this needs to be dealt with by you and the developer of the plug-in. If it's inside the wall it is most likely content from external sources that a member has posted from a http site. You can either delete this or just let it disappear as the wall feed gets newer posts.
Kev
Apr 7 '15
Thanks for the info on this, Kenneth. This seems to have fixed a number of mixed content issues for me. However, I am still having issues whereby some mixed content is being generated when people like to things like blog posts within the newsfeed.
If there a way to tell oxwall to not loads a thumbnail if it isn't SSL enable?
Thanks,
Kev
Team ross
Apr 8 '15
This is a custom code modification. You can do that on your own, if you're good at programming or hire a programmer, you can do that here: http://www.oxwall.org/market/specialists
Kenneth
Apr 8 '15
Oxwall is an open source platform that currently has outdated documentation (They are currently working on updating these docs so users like yourself can get up to date on development inside their platform) This being said if you are SSL your best bet is to host as much as possible within the sites cloud or server to avoid complications with mixed content.
There are three main options I can see.
1. Force of hand, This means you correct Oxwall to only accept https content and tell the user "please use secure content via-SSL and https"
2. Edit your Oxwall like ross has said by either editing it yourself or hiring someone else to look at it (if you go down this road many people forget to tell you this but Oxwall does not save custom editing so make sure you either save a backup of the code or learn what the developer did to fix it)
3. just completely turn off lines in the code that show mix-media, Example is if they like or comment on a video/photo etc it will show the text but not the mix-content they will need to click it or "read more" to see it.
Final notes:
I have been working on correcting SSL for awhile now and Oxwall is not quite up to full content support due to third party plug-ins and it's constantly trying to add new features to it's platform while making small tweaks to it's previous additions. The only true two ways you will have a 100% SSL protected site is
1. Only host content from your site with CDN to help speed things up and protect your site.
2. Never use third party plug-ins (Which is really hard to do) often I find most problems come from third party plug-ins and do remember it's not their job to make it SSL enabled it's only their job to make sure the plug-in works on the platform it's advertised on so always ask them first how well it works on SSL many API etc that these plug-ins use don't use SSL protected API or content.
Thanks for the info on this, Kenneth. This seems to have fixed a number of mixed content issues for me. However, I am still having issues whereby some mixed content is being generated when people like to things like blog posts within the newsfeed.
If there a way to tell oxwall to not loads a thumbnail if it isn't SSL enable?
Thanks,
Kev
Kev
Apr 8 '15
Thanks for the info guys, and in particular, Kenneth. I really appreciate the in-depth response. I'd be happy to make any changes required, the problem is, I don't know what changes I need to make.
I'm currently working with a developer on a mobile app for my site (which is how this whole thing cam about, as Google requires SSL for push notifications, apparently). So I'll speak with him, and work with him to resolve any mixed content issues.
Thanks again.
Kev
Apr 17 '15
This custom content issue is really killing me. It's actually stopping my app from working on a regular basis. Is there a way to simply stop thumbnails being loaded when a link is posted on the newsfeed? Either that, or a way up uploading the thumbnail to my server so that it's served as HTTPS?
Luther
Apr 21 '16
Probleme https oxwall 1.8.1 when i edit config.php
define('OW_URL_HOME', 'http://www.yoursite.com/');
to
define('OW_URL_HOME', 'https://www.yoursite.com/');
define('OW_URL_HOME', 'http://www.yoursite.com/');
to
define('OW_URL_HOME', 'https://www.yoursite.com/');
I have : "The page isn't redirecting properly". How i can resolve?
Team ross
Apr 22 '16
Luther, you will need to check whether you have default .htaccess file in the root of the software. Make sure it has default content. If it does, you need to contact your hosting provider and make sure you have mod_rewrite enabled and properly configured.
Team ross
Apr 27 '16
So you don't have ssl certificate installed you want to make your site https via htaccess condiition?
Kenneth
Apr 28 '16
The problem is not hosting . Ssl work fine in my hosting How can configure .htaccess?What type of SSL did you order and do you have subdomains etc? for example if you have subdomains you need to have some custom code in .htaccess to have SSL on subdomains however, if you just have a basic single domain and just website.com/page this will work without such SSL types like wildcard etc. This might sound silly but switch back to then contact support and have them change it to when the error happens they can see for themselves it's not on OxWalls side. Finally, Make sure when buying any SSL you research before buying it, you might get one that is to complicated to configure.when i put :
- RewriteCond %{HTTPS} off
- RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
i have error many redirect
Kenneth
Apr 29 '16
I have ssl Comodo PositiveSSL Certificate . I no have the subdomainsDo you have cloudflare? cloudflare often doesn't work correctly with SSL unless you pay the 20$ a month for premium from them.
Leader dave
May 6 '16
The only time i ever used SSL was when i had a VPS and so i had root access which made it easier to set up. But on a shared server all i know about SSL Certs is that some of them like rapid SSL you have to reverse the keys. Most SSL you post one key in the top box and the other key in the lower box. But rapid SSL are different. You reverse the keys when you post them in the box's. Meaning the one that would normally go in the top box actually goes in the bottom box. Thats what i remember. I do not know if Comodo is like that or not.
Morena Milani
May 17 '16
I solved the problem, warning to those who site in https to upload videos only with button "https://www.youtube.com" by performing the modification to link from http to https padlock disappears because the preview image is not contained sure.
The Forum post is edited by Morena Milani May 17 '16
Kenneth
May 17 '16
I solved the problem, warning to those who site in https to upload videos only with button "https://www.youtube.com" by performing the modification to link from http to https padlock disappears because the preview image is not contained sure.OxWall has just informed me they have added this problem to their road map.
Morena Milani
Sep 20 '16
I talked to specialists and they told me that you can not solve the problem al100% because some pages remain in http and this will be seen.
