snipe / snipe-it

A free open source IT asset/license management system
https://snipeitapp.com
GNU Affero General Public License v3.0
11.19k stars 3.2k forks source link

favicon requested using incorrect HTTP/S schema #11945

Open MrDetonia opened 2 years ago

MrDetonia commented 2 years ago

Debug mode

Describe the bug

When using HTTPS, a custom favicon is requested over HTTP, resulting in the content being blocked by browsers due to mixed HTTPS/HTTP content.

Reproduction steps

  1. Enable HTTPS
  2. Upload custom favicon
  3. Disable / clear browser cache and log in to Snipe IT
  4. Monitor network requests in browser dev tools and see the blocked request.

Expected behavior

Favicon is requested in a schema that matches the one currently being used, e.g. HTTP when using HTTP, HTTPS when using HTTPS.

Screenshots

image snipeit

Snipe-IT Version

6.0.10

Operating System

Debian 11

Web Server

Apache

PHP Version

7.4.32

Operating System

Windows

Browser

Edge, Chrome, Brave

Version

Latest

Device

No response

Operating System

No response

Browser

No response

Version

No response

Error messages

No response

Additional context

Fresh install from Github. No Docker or container manager etc.

welcome[bot] commented 2 years ago

👋 Thanks for opening your first issue here! If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.

snipe commented 2 years ago

We do not ever hard code protocols into your urls, since we have no way of knowing whether you’re running TLS or not.

https://github.com/snipe/snipe-it/blob/fbfc9d123cb1e0dae5c5b22b4a3f2a0b0d0639cb/resources/views/layouts/default.blade.php#L18-L20

This is all dictated by your APP_URL in your .env

MoralCode commented 1 year ago

i had a similar issue where some styles were HTTP and others were HTTPS because my snipe install is behind a proxy and something got restarted causing the IP address i had set in APP_TRUSTED_PROXIES (link to docs) to be wrong.

WimSuenens commented 1 year ago

There's an extra space at the end in the link for the favicon.

<link rel="shortcut icon" type="image/ico" href="{{ ($snipeSettings) && ($snipeSettings->favicon!='') ?  Storage::disk('public')->url(e($snipeSettings->favicon)) : config('app.url').'/favicon.ico' }} "> 

Could that be the issue?