Mixed Content Warning / Cannot open Editor anymore

[amenk]

1. insert svg Diagram to wiki page
2. Double click to edit

3. Chrome warning / does not load:

   Mixed Content: The page at 'https://tracker.example.com/projects/foobar/wiki/Systemlandschaft'
   was loaded over HTTPS, but requested an insecure resource 'http://www.draw.io/?
   embed=1&ui=atlas&spin=1&modified=unsavedChanges&proto=json&https=0'. This request has
   been blocked; the content must be served over HTTPS.

[amenk]

Also does not work for issues - it was working before...

[mikitex70]

Check the drawio URL in the plugin configuration and make sure the url is //www.draw.io (without protocol). If the protocol is specified then it is forced and some browsers don't let change the protocol from HTTPS to HTTP.

[amenk]

It is set that way ... also we did not change anything. Maybe there was a change on draw.io ? I notices the http=0 parameter for example in the URL.

[amenk]

The first call is also to a https URL:

https://www.draw.io/?embed=1&ui=atlas&spin=1&modified=unsavedChanges&proto=json&https=0

[amenk]

I guess setting it to https:// would work for now. But the // does not seem to be supported in the following code:

https://github.com/mikitex70/redmine_drawio/blob/master/assets/javascripts/drawioEditor.js#L138

Actually this code is a month old and does not explain why the bug come up today.

// Disables SSL if the protocol isn't HTTPS; simplifies use of local drawio installations
var useHttps = (Drawio.settings.drawioUrl.match(/^https:/i)? 1: 0);

window.addEventListener('message', receive);
iframe.setAttribute('src', Drawio.settings.drawioUrl+'?embed=1&ui=atlas&spin=1&modified=unsavedChanges&proto=json&https='+useHttps);
document.body.appendChild(iframe);

[amenk]

Workaround: Setting the URL explicitly to https://draw.io works for us (as the instance is only accessible via https anyways)

[mikitex70]

I've pushed a fix in the develop branch. A quick fix without the need to upgrade the plugin would be to specify https://www.draw.io in plugin configuration, so the autodetection of protocol would be bypassed. The auto-disabling of the https protocol is needed for local drawio installations (for example in Tomcat) without setting a certificate.