Closed enricozamprogno closed 1 year ago
This code isn't to do with link tracking. It seems to be displaying a remote page when someone is forwarding an email but it's a bit unclear to me.
There is similar processing in the file admin/sendemaillib.php to prepend http://
to the remote URL. I think it would be clearer to validate that an entered remote URL is actually a full URL, i.e. starts with http:
or https:
That is in file admin/send_core.php, which currently validates that the URL can be fetched
if ($messagedata['sendmethod'] == 'remoteurl') {
$code = testUrl($messagedata['sendurl']);
if ($code != 200) {
$allReady = false;
I can't remember either. It says "remote response page" and seems to expect [URL:XXX] as the message data to fetch a URL from. It only adds the http:// is it's not there, so I don't think this change is needed. Not only that it is about a remote URL, not one on this server, so using local ENV vars has no use.
I really can't remember why this was done, and it doesn't seem to be documented either
I think I understand when the problem occurs. The scheme substitution from https to http occurs only when creating a message from rss feed. If I send the message with "Send Test" the https URLs are not changed but if phplist performs a scheduled trasmission the URLs scheme from https become http. It was this behavior that misled me and led me to think that the patch I proposed worked. Sorry, i close the pull request. Thank you for ypur time.
Use https url for remote content when secure protocol is enabled
Description
From the security point of view it looks better using https protocol whenever possible
Related Issue
If server host support only https, phplist traking links is not working
Screenshots (if appropriate):