Bug 285163

Summary:	Mixed content (secure and insecure) on overlays.gentoo.org
Product:	Gentoo Infrastructure	Reporter:	Nico R. <n-roeser>
Component:	Other	Assignee:	Gentoo Overlays Project <overlays>
Status:	RESOLVED WONTFIX
Severity:	normal	Keywords:	SECURITY
Priority:	High
Version:	unspecified
Hardware:	All
OS:	All
URL:	https://overlays.gentoo.org/
Whiteboard:
Package list:		Runtime testing required:	---

Description Nico R. 2009-09-16 07:48:15 UTC

overlays.gentoo.org delivers insecure content (via HTTP) when you are accessing it by HTTPS: the header of the delivered web pages includes the image from
http://overlays.gentoo.org/trac/gentoo-20060214/gentoo-overlays.png

Reproduce:
Use Firefox and go to https://overlays.gentoo.org/ with the warning for mixed content enabled.

Or use openssl s_client or curl or whatever else to retrieve https://overlays.gentoo.org/ and grep for "http://". You can see that content is included via HTTP.

*And* you can see many, many links which start with "http://overlays.gentoo.org/". While this is not an immediate problem, the links should really drop the protocol and domain parts so that users will stay on HTTPS once connected.

Workaround:
Use NoScript extension for Firefox and set it to always use HTTPS for overlays.gentoo.org. Or use a transparent proxy and filter the content.

Comment 1 Robin Johnson archtester

2009-09-16 09:31:39 UTC

jokey: your field.

Comment 2 Theo Chatzimichos (RETIRED) archtester

2012-06-27 16:04:37 UTC

the overlays.gentoo.org instance is unmaintained and I plan to replace it with redmine/chilli. Sorry but WONTFIX