-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Description
yourls_get_favicon_url() seems to take for granted that PHP will always share the same protocol as the frontend server.
Problem: generated favicon protocol doesn't match admin console protocol when Yourls is behind a reverse proxy.
Steps to reproduce:
- Yourls is behind nginx reverse proxy: e.g. Apache/PHP (HTTP) <=> Nginx (HTTPS) <=> Client
- Visit
https://my.yours.installation/xxx+to see the stats of thexxxshort URL
When these conditions are met, the favicon address to the long URL domain is generated using HTTP http://www.google.com/s2/favicons/..... instead of HTTPS, in some situations the favicon won't show up on the stats page.
Also a few warnings about mixed content can be observed in the console.
Would it make more sense to use a protol relative address instead: //www.google.com/s2/favicons/..... ?
Using the following code made the warnings go away and the favicons show up:
function yourls_get_favicon_url( $url ) {
return yourls_match_current_protocol( '//www.google.com/s2/favicons?domain=' . yourls_get_domain( $url, false ) );
}
(I only removed the hardcoded "http:" from the URL)

