owncloud-archive / news

:newspaper: News app for ownCloud
GNU Affero General Public License v3.0
290 stars 106 forks source link

Insecure elements being served through SSL #943

Closed dbenoy closed 8 years ago

dbenoy commented 8 years ago

When visiting the news reader via HTTPS, if it's reading from a source that references standard HTTP (or is itself standard HTTP, in the case of the favorite icon), it will directly link to unencrypted images. This causes browsers to get rid of their little green padlock and present warnings, and it exposes the potential for MITM manipulation of the page and eavesdropping on which news feeds you're subscribed to.

This could be solved by getting the news app to fetch and save images so it can serve them up itself, or proxying them on demand.

BernhardPosselt commented 8 years ago

Please read the first entry in the FAQ https://github.com/owncloud/news#my-browser-shows-a-mixed-content-warning-connection-is-not-secure

dbenoy commented 8 years ago

Oh! I guess that makes sense. Okay.