search

freedomofpress / securethenews

An automated scanner and web dashboard for tracking TLS deployment across news organizations
https://securethe.news
GNU Affero General Public License v3.0
100 stars 25 forks source link

Pin django-analytical to fix mixed content issue #78

Closed garrettr closed 7 years ago

garrettr commented 7 years ago

django-analytical's Piwik integration introduced a mixed content issue on Secure the News for users with Javascript disabled because it hard-coded an http scheme for the fallback tracking pixel. I fixed the issue upstream in https://github.com/jcassee/django-analytical/pull/101, but the maintainers haven't cut a new release yet, so for now we will pin to the fixed commit on the upstream master branch.

garrettr commented 7 years ago

I have tested this in the development environment and confirmed that the Piwik tracking code uses a protocol-relative URL instead of hardcoding http://.

msheiny commented 7 years ago

Rebasing this on master

msheiny commented 7 years ago

im still seeing hard-coded right now but it could be a CDN problem. going to try hitting locally against server to confirm.

garrettr commented 7 years ago

@msheiny Gut feeling: it's an issue with Ansible idempotence and pip. Can you confirm that the updated django-analytical dependency was installed?

msheiny commented 7 years ago

yeeppp -- something funky is up, I dug into site-packages and confirm your change isnt showing up.. debuging

msheiny commented 7 years ago

Okay -- I'm all good for go. This is deployed now. I had to manually push it through so I'll have to reevaluate our pip automation scripts and what we can do to work-around this issue in the future.