{"action":"created","issue":{"url":"https://api.github.com/repos/modxcms/revolution/issues/12805","labels_url":"https://api.github.com/repos/modxcms/revolution/issues/12805/labels{/name}","comments_url":"https://api.github.com/repos/modxcms/revolution/issues/12805/comments","events_url":"https://api.github.com/repos/modxcms/revolution/issues/12805/events","html_url":"https://github.com/modxcms/revolution/issues/12805","id":120591461,"number":12805,"title":"MODX news feed and SSL","user":{"login":"exside","id":445501,"avatar_url":"https://avatars.githubusercontent.com/u/445501?v=3","gravatar_id":"","url":"https://api.github.com/users/exside","html_url":"https://github.com/exside","followers_url":"https://api.github.com/users/exside/followers","following_url":"https://api.github.com/users/exside/following{/other_user}","gists_url":"https://api.github.com/users/exside/gists{/gist_id}","starred_url":"https://api.github.com/users/exside/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/exside/subscriptions","organizations_url":"https://api.github.com/users/exside/orgs","repos_url":"https://api.github.com/users/exside/repos","events_url":"https://api.github.com/users/exside/events{/privacy}","received_events_url":"https://api.github.com/users/exside/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-05T22:09:40Z","updated_at":"2015-12-06T00:13:57Z","closed_at":null,"body":"Just switched my sites to Let's Encrypt SSL and noticed, that the MODX News Feed dashboard widget throws a mixed content warning because of the smiley added to a news entry (2.4.2)...\r\n\r\n```\r\nMixed Content: The page at 'https://www.somesite.tld/manager/' was loaded over HTTPS, but requested an insecure image 'http://modx.com/assets/components/discuss/themes/modx/images/smileys/laugh.gif'. This content should also be served over HTTPS.\r\n```\r\n\r\nThis could easily be avoided by just using a protocol relative url for that smiley, e.g.\r\n\r\n```\r\n//modx.com/assets/components/discuss/themes/modx/images/smileys/laugh.gif\r\n```\r\n\r\nWhile this doesn't actually make the manager less secure, it is desirable to show the SSL lock icon (or similar) to clients and myself. The only solution is to either disable the feed altogether or write some kind of proxy script that strips out the image tags in news entries, which seems overkill, so I'd kindly ask that somebody with access to that news feed content changes that URL to be protocol relative (and that should be checked each time a new entry is published =D)"},"comment":{"url":"https://api.github.com/repos/modxcms/revolution/issues/comments/162258759","html_url":"https://github.com/modxcms/revolution/issues/12805#issuecomment-162258759","issue_url":"https://api.github.com/repos/modxcms/revolution/issues/12805","id":162258759,"user":{"login":"Mark-H","id":312944,"avatar_url":"https://avatars.githubusercontent.com/u/312944?v=3","gravatar_id":"","url":"https://api.github.com/users/Mark-H","html_url":"https://github.com/Mark-H","followers_url":"https://api.github.com/users/Mark-H/followers","following_url":"https://api.github.com/users/Mark-H/following{/other_user}","gists_url":"https://api.github.com/users/Mark-H/gists{/gist_id}","starred_url":"https://api.github.com/users/Mark-H/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Mark-H/subscriptions","organizations_url":"https://api.github.com/users/Mark-H/orgs","repos_url":"https://api.github.com/users/Mark-H/repos","events_url":"https://api.github.com/users/Mark-H/events{/privacy}","received_events_url":"https://api.github.com/users/Mark-H/received_events","type":"User","site_admin":false},"created_at":"2015-12-06T00:13:57Z","updated_at":"2015-12-06T00:13:57Z","body":"One slight problem there is that MODX.com doesn't work over https...\nOp 5 dec. 2015 11:09 p.m. schreef \"Lukas Zahnd\" <notifications@github.com>:\n\n> Just switched my sites to Let's Encrypt SSL and noticed, that the MODX\n> News Feed dashbaord widget throws a mixed content warning because of the\n> smiley added to a news entry (2.4.2)...\n>\n> Mixed Content: The page at 'https://www.somesite.tld/manager/' was loaded over HTTPS, but requested an insecure image 'http://modx.com/assets/components/discuss/themes/modx/images/smileys/laugh.gif'. This content should also be served over HTTPS.\n>\n> This could easily be avoided by just using a protocol relative url for\n> that smiley, e.g.\n>\n> //modx.com/assets/components/discuss/themes/modx/images/smileys/laugh.gif\n>\n> While this doesn't actually make the manager less secure, it is desirable\n> to show the SSL lock icon (or similar) to clients and myself. The only\n> solution is to either disable the feed altogether or write some kind of\n> proxy script that strips out the image tags in news entries, which seems\n> overkill, so I'd kindly ask that somebody with access to that news feed\n> content changes that URL to be protocol relative (and that should be\n> checked each time a new entry is published =D)\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/modxcms/revolution/issues/12805>.\n>\n"}}