William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

In pages with map, an image is referenced:

http://assets1.geocommons.com/d51ab13...

Which causes problems if the site is HTTPS (this is an insecure link), so you get the caution triangle.

This is just a placeholder image, so why not include it in other images loaded with Appery assets?

For my deployment I can edit my main page .html file, but it would be better if this dependency was eliminated.

Image

Evgene Karachevtsev
Posts: 12
Joined: Mon Apr 28, 2014 1:12 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

Hello William,

This picture is available via http and via https. This is API of Google maps and there is nothing we can do with it, we can't cache it

William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

This is put in the project HTML file when a map is added to the page. I think it's a placeholder until google maps is loaded.

If you create a new app, add a google map, and look at the generated startScreen.html page you will see it.

For example,

http://justamap.herokuapp.com/startSc...

Here's the div, including the "tiggzitype" attribute . . . .

Code: Select all

                 [img]https://sslproxy.getsatisfaction.com/sslproxy/SWhAdDNLMG5zdGFuVGlWesDkulkDJFT8yaEQr7bYAleJlUj-NGFPfHUqA59NFzhaI_jF3qAffJTuzVj8kEH8Gr991JtJHbkSe6i_aPYpbe8opQlJ0ZmTaM0csIT6rMWuwBtR3cfH7BpnwB6QOs6MafCWOLT6eIEKFfcejLNUQNk=.png[/img] 
William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

I tried to put raw html in there but it is rendering. Look at the source.

Yurii Orishchuk
Posts: 0
Joined: Fri Feb 14, 2014 8:20 am

Direct insecure access to 3rd party image (geocommons.com) google map widget

Hi WIlliam,

Here is what is see when tried your public link:

http://prntscr.com/4rn1zi/direct

Is that desired result?

Regards.

William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

Sure, the code works fine per se, but when I deploy this on a web server with SSL, I get a warning from the browser that the page contains non-secure content.

My app is going to a trial. I don't want to explain this browser warning multiple times since people are so paranoid about security now.

The problem is that Appery adds an image placeholder in the DOM in the startScree.html it creates.

Here it is with "+" instead of " link with something from my project and the security warning is gone. This is a pain because I have to do it every time I update code on a web server. But less of a pain than explaining it to users.

It would be nice if Appery would add the image to the project so that it will not load an image from some random website at runtime.

And also I suspect that if someone builds phone gap, you still have this image being pulled for no particular reason, every time the app starts.

William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

This system really hates html . . . .

++ div id="startScreen_googlemap_2" dsid="googlemap_2" name="googlemap_2" data-role="appery_googlemap"
tiggzitype="object" apperytype="object" class='startScreen_googlemap_2' style='width:100%;' ++
++Imagehttp://assets1.geocommons.com/d51ab1366 ... 1311276822" rel="nofollow"http://assets1.geocommons.com/d51ab13.../a"
/++
++

William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

argh now it gobbled up the link

src=http://
assets1.geocommons.com/
d51ab1366bec6a2c4954db979e5921bd4cc140db/
images/no_preview_map.png?1311276822

Yurii Orishchuk
Posts: 0
Joined: Fri Feb 14, 2014 8:20 am

Direct insecure access to 3rd party image (geocommons.com) google map widget

william,

Do you solve this problem?

This time i've understood about what you want to do.

Try this:

Add "page load" event handler and populate it with following code:

pre

//Use here map component name.
var mapName = "googlemap_161";

Use here page name.
var pageName = "test";

jQuery("." + pageName + "_" + mapName).removeAttr("src");

/pre

Regards.

William Bradee
Posts: 0
Joined: Thu Oct 03, 2013 8:45 pm

Direct insecure access to 3rd party image (geocommons.com) google map widget

Thanks for your suggestion.
That may or may not work, but it still includes the URL of the image in the source, which I would like to avoid. I see in the code it just includes a phantom "img" along with the map. That's really the issue, it shouldn't (in my opinion), you should make it configurable, or it should be added to the project so it's all coming from the same domain.

Anyway, the only reason I had this is that I used a dummy page with a map to get the google apis to load. I use Javascript of my own to draw the maps.

Now I realized there's a "External Resources" tab on "App Settings" where I can add the google maps api JS (or any other library) to load. So I deleted this dummy map and I no longer have the phantom image.

Return to “Issues”