phpList / phplist3

Fully functional Open Source email marketing manager for creating, sending, integrating, and analysing email campaigns and newsletters.
https://www.phplist.org
GNU Affero General Public License v3.0
737 stars 268 forks source link

Support for https only hosts #965

Closed enricozamprogno closed 1 year ago

enricozamprogno commented 1 year ago

Use https url for remote content when secure protocol is enabled

Description

From the security point of view it looks better using https protocol whenever possible

Related Issue

If server host support only https, phplist traking links is not working

Screenshots (if appropriate):

bramley commented 1 year ago

This code isn't to do with link tracking. It seems to be displaying a remote page when someone is forwarding an email but it's a bit unclear to me.

There is similar processing in the file admin/sendemaillib.php to prepend http:// to the remote URL. I think it would be clearer to validate that an entered remote URL is actually a full URL, i.e. starts with http: or https: That is in file admin/send_core.php, which currently validates that the URL can be fetched

if ($messagedata['sendmethod'] == 'remoteurl') {
    $code = testUrl($messagedata['sendurl']);
    if ($code != 200) {
        $allReady = false;
michield commented 1 year ago

I can't remember either. It says "remote response page" and seems to expect [URL:XXX] as the message data to fetch a URL from. It only adds the http:// is it's not there, so I don't think this change is needed. Not only that it is about a remote URL, not one on this server, so using local ENV vars has no use.

I really can't remember why this was done, and it doesn't seem to be documented either

enricozamprogno commented 1 year ago

I think I understand when the problem occurs. The scheme substitution from https to http occurs only when creating a message from rss feed. If I send the message with "Send Test" the https URLs are not changed but if phplist performs a scheduled trasmission the URLs scheme from https become http. It was this behavior that misled me and led me to think that the patch I proposed worked. Sorry, i close the pull request. Thank you for ypur time.