Skip to content

yourls_get_favicon_url is abused by yourls_match_current_protocol #2430

@tobozo

Description

@tobozo

yourls_get_favicon_url() seems to take for granted that PHP will always share the same protocol as the frontend server.

Problem: generated favicon protocol doesn't match admin console protocol when Yourls is behind a reverse proxy.

image

Steps to reproduce:

  1. Yourls is behind nginx reverse proxy: e.g. Apache/PHP (HTTP) <=> Nginx (HTTPS) <=> Client
  2. Visit https://my.yours.installation/xxx+ to see the stats of the xxx short URL

When these conditions are met, the favicon address to the long URL domain is generated using HTTP http://www.google.com/s2/favicons/..... instead of HTTPS, in some situations the favicon won't show up on the stats page.

Also a few warnings about mixed content can be observed in the console.

image

Would it make more sense to use a protol relative address instead: //www.google.com/s2/favicons/..... ?

Using the following code made the warnings go away and the favicons show up:

function yourls_get_favicon_url( $url ) {
        return yourls_match_current_protocol( '//www.google.com/s2/favicons?domain=' . yourls_get_domain( $url, false ) );
}

(I only removed the hardcoded "http:" from the URL)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions