Non-secure calls made by ED javascript
By Jordan Weinstein on Thursday, 19 January 2017
Posted in Technical Issues
Replies 5
Likes 0
Views 402
Votes 0
Hi,

Loading Easydiscuss breaks HTTPS on my site (lose padlock in the browser).

The reason is linked to this being loaded by media/com_easydiscuss/scripts/site/easydiscuss-4.0.11.js



{var e=[{id:1,name:"Kenneth Auchenberg",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:2,name:"Jon Froda",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:3,name:"Anders Pollas",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:4,name:"Kasper Hulthin",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:5,name:"Andreas Haugstrup",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:6,name:"Pete Lacey",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:7,name:"kenneth@auchenberg.dk",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:8,name:"Pete Awesome Lacey",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"},{id:9,name:"Kenneth Hulthin",avatar:"http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif",type:"contact"}


The call to these avatars from HTTP (rather than HTTPS) breaks security. Not sure what these avatars are anyways. I deleted the URLs and left the avatar as just avatar:"". This restored the padlock to my site.

What are these avatars called for anyways? That website (4dots) does not seem to serve a secure version of the image.

Jordan
hey jordan,

Is it possible provide us with your following details so we can better have a check?

1. Joomla backend access
2. FTP access
3. some of the screenshot regarding that avatar area you referring.
Arlex Wong
·
Thursday, 19 January 2017 12:33
·
0 Likes
·
0 Votes
·
0 Comments
·
I have already fixed the issue on our site.

But you can very easily see for yourself in your own JS file (attached). Search for:

http://cdn0.4dots.com/i/customavatars/avatar7112_1.gif

There are several calls for this belonging to a bunch of sample users that are included in this JS file:

Jon Froda
Andreas Haugstrup
etc

Jordan
Jordan Weinstein
·
Thursday, 19 January 2017 20:58
·
0 Likes
·
0 Votes
·
0 Comments
·
Hello Jordan,

Yes, you are right! This is a debug code which we have accidentally slipped in but rest assured that these codes aren't used anywhere on the script. This will be fixed in the next release of EasyDiscuss.
Mark
·
Thursday, 19 January 2017 23:13
·
0 Likes
·
0 Votes
·
0 Comments
·
Thanks Mark,

On one site, loading those resources broke padlock on HTTPS.

Jordan
Jordan Weinstein
·
Friday, 20 January 2017 00:13
·
0 Likes
·
0 Votes
·
0 Comments
·
Hm, there's a possibility that the browser is also scanning it somehow but this will be fixed on the next release definitely
Mark
·
Friday, 20 January 2017 00:16
·
0 Likes
·
0 Votes
·
0 Comments
·
View Full Post