Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 08 Jul 2019, 00:18
Panzer Max's Avatar
Panzer Max Panzer Max is offline
 
Join Date: May 2006
Real name: Pam
Changing over to https

So, finally started the fun of getting our site switched over to https. Forum is working, most of the rest of the site is getting the sacred padlock.

But the forum does have ONE image that is mysteriously showing up as not cooperating.

An image with an insecure url of "http://www.subsim.com/radioroom/images/icons/icon1.png" was loaded on line: 742 of https://www.subsim.com/radioroom/index.php.
Ok, so it sound like maybe that one icon was hardcoded into a template or php file somewhere, god only knows why. I have searched all the templates for icon1.png and http://www.subsim.com.... nothing!

I've checked the Styles CSS and MainVar section... nada!

I've dug through the php files. Cannot find it.

So, the friendly folks at vBulletin suggested using a 301 redirect and that will work, but now I want clean up as much as I can, and I gots to know, just where can I find where vBull sets the "thread icons" ?>?

Edit: Wayne+Omnibus pointed me in the right direction, vBulletin Options/Thread Display Options
Attached Images
File Type: jpg iconhighlited.JPG (18.7 KB, 12 views)

Last edited by Panzer Max; 08 Jul 2019 at 10:28.
Reply With Quote
  #2  
Old 08 Jul 2019, 13:20
Dave Dave is offline
 
Join Date: Jun 2010
Real name: Dave
Tip: create a style replacement variable in your styles to replace http://www.subsim.com with https://www.subsim.com
__________________
https://technidev.com - security, development, exploits, vBulletin
dave[at]technidev[dot]com

Contact me for custom vBulletin 3/4 work & server/website management.
Reply With Quote
  #3  
Old 08 Jul 2019, 18:41
Panzer Max's Avatar
Panzer Max Panzer Max is offline
 
Join Date: May 2006
Real name: Pam
Thanks, Dave. Yes, we did that. It was that one remaining default icon setting, I could swear I went through all the VB settings, I don't know how I missed that one, it was pretty obvious.
Reply With Quote
  #4  
Old 08 Jul 2019, 20:34
In Omnibus's Avatar
In Omnibus In Omnibus is offline
 
Join Date: Apr 2010
Real name: Kris
Originally Posted by Panzer Max View Post
Thanks, Dave. Yes, we did that. It was that one remaining default icon setting, I could swear I went through all the VB settings, I don't know how I missed that one, it was pretty obvious.
Like Wayne said in the other forum it's easy to miss. vB3.x wasn't exactly laid out with ease of use in mind.
Reply With Quote
  #5  
Old 08 Jul 2019, 23:00
final kaoss final kaoss is offline
 
Join Date: Apr 2006
In that case, add this to your headers


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

More info: CSP: upgrade-insecure-requests - HTTP | MDN

To sum it up, if a asset can be served via SSL (https) and isn't, then adding this tag will force it to be served via SSL.

Last edited by final kaoss; 08 Jul 2019 at 23:06.
Reply With Quote
  #6  
Old 08 Jul 2019, 23:28
Panzer Max's Avatar
Panzer Max Panzer Max is offline
 
Join Date: May 2006
Real name: Pam
Originally Posted by final kaoss View Post
In that case, add this to your headers


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

More info: CSP: upgrade-insecure-requests - HTTP | MDN

To sum it up, if a asset can be served via SSL (https) and isn't, then adding this tag will force it to be served via SSL.
Ok, kaoss, I'm on it!

Originally Posted by In Omnibus View Post
Like Wayne said in the other forum it's easy to miss. vB3.x wasn't exactly laid out with ease of use in mind.
First let me thank you again! So nice to help.

I'm still shaking my head My first thought was to check the style templates with a search. Then we checked the StyleVars and CSS. Then I went through the various vBulletin Options, one at a time, looking for anything related to that icon, or anything with an http:// prefix. I must have skipped that one, and never looked back. I spent several hours checking php files, wow, it was so easy but I missed it!
Attached Images
File Type: jpg thread_display.JPG (50.2 KB, 8 views)
Reply With Quote
  #7  
Old 10 Aug 2019, 02:14
kevinh kevinh is offline
 
Join Date: May 2007
Originally Posted by Panzer Max View Post
So, finally started the fun of getting our site switched over to https.
Hi Panzer Max, would you mind briefly explaining the steps to switch a vBulletin site to https ?
Reply With Quote
  #8  
Old 10 Aug 2019, 09:03
snakes1100 snakes1100 is offline
 
Join Date: Dec 2001
Real name: Anthony
1. Buy SSL Cert
2. Install on server.
3. Setup apache/nginx whatever your running to serve the site in SSL & force a 301 to https
4. Change forum URL to https in the admincp
5. Fix any issues related to images etc by using to dev console in your browser, which could be smilies, post icons etc.
Reply With Quote
  #9  
Old 10 Aug 2019, 14:24
Panzer Max's Avatar
Panzer Max Panzer Max is offline
 
Join Date: May 2006
Real name: Pam
Originally Posted by kevinh View Post
Hi Panzer Max, would you mind briefly explaining the steps to switch a vBulletin site to https ?
Hi Kevin, in our case, our data center manager called and said he had to upgrade our php to a higher version for security. Not being sure our 3.8 forum would actually work on newer versions of php, we had been hanging on to an outdated version to keep 3.8 running. We don't know if there were compatibility errors with vB, but he said he went through the whole site and fixed a few php errors.

At some point in the php upgrade he installed the SSL certificates through cPanel.

This explains the nginx change snakes is referring to. I did not make this change, I assume the DC tech did this in conjunction with the SSL certificates, but I will need to confirm.

Our admin changed the htaccess file to force the redirect to https

Then I got the job of searching the templates for http://www.oursite.com and changing to https://www.oursite.com
I also checked all the php pages in the vB folders for any mention of http

Last, we have a team who have been going through all 1800 html and php pages on site to find and replace http://www.oursite.com with https://www.oursite.com

Then some spot checking with https://www.whynopadlock.com/
Reply With Quote
Reply

Similar Threads
Thread Thread Starter Forum Replies Last Post
Over 50 custom smilies, symbols and over 250 flags Deathstar vBulletin Smilie Sets 17 28 Nov 2005 15:31



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 11:00.

Layout Options | Width: Wide Color: