Mailtrain-org / mailtrain

Self hosted newsletter app
GNU General Public License v3.0
5.52k stars 692 forks source link

GrapeJs sometimes upload images with wrong scheme (http instead of https) #261

Closed thperret closed 7 years ago

thperret commented 7 years ago

Hi,

When uploading images through GrapeJs editor, it sometimes upload them using http:// scheme instead of https:// configured one. The very weird thing is that when I quit the editor and come back to it, the first image uploaded it generally uploaded through http:// then through http://. This give a 500 error since GrapeJs tries then to convert the image using ImageMagick with the http:// scheme which is redirected (and not followed by ImageMagick).

example of error log:

info HTTP GET /editorapi/img?src=http%3A%2F%2Fmailtrain.example.org%2Fgrapejs%2Fuploads%2F0%2Fimg.png&method=resize&params=520%2C89 500 280.182 ms - 126

I'm running Mailtrain with docker using the official Dockerfile with version 1.24.0 with a nginx reverse proxy.

Nginx configuration:

server {
    listen        80;
    server_name   mailtrain.example.org;
    rewrite       ^ https://mailtrain.example.org$request_uri? permanent;
}

server {
    listen        443;
    server_name   mailtrain.example.org;

    ssl           on;
    ssl_certificate /etc/ssl/certs/public.pem;
    ssl_certificate_key     /etc/ssl/certs/server.key;

    ssl_prefer_server_ciphers on;
    ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers               ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3000;
        proxy_redirect off;
    }
}
thperret commented 7 years ago

Forgot to say that I temporarily fixed it with a ugly hack: in routes/editorapi.js#L266 I added:

                src = src.replace('http://', 'https://');
witzig commented 7 years ago

Thanks for reporting. This should be fixed now with 277b2ca.