Page 1 of 2

Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Mon Sep 29, 2014 6:04 pm
by William Bradee

In pages with map, an image is referenced:

http://assets1.geocommons.com/d51ab13...

Which causes problems if the site is HTTPS (this is an insecure link), so you get the caution triangle.

This is just a placeholder image, so why not include it in other images loaded with Appery assets?

For my deployment I can edit my main page .html file, but it would be better if this dependency was eliminated.

Image


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Mon Sep 29, 2014 8:01 pm
by Evgene Karachevtsev

Hello William,

This picture is available via http and via https. This is API of Google maps and there is nothing we can do with it, we can't cache it


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Mon Sep 29, 2014 8:49 pm
by William Bradee

This is put in the project HTML file when a map is added to the page. I think it's a placeholder until google maps is loaded.

If you create a new app, add a google map, and look at the generated startScreen.html page you will see it.

For example,

http://justamap.herokuapp.com/startSc...

Here's the div, including the "tiggzitype" attribute . . . .

Code: Select all

                 [img]https://sslproxy.getsatisfaction.com/sslproxy/SWhAdDNLMG5zdGFuVGlWesDkulkDJFT8yaEQr7bYAleJlUj-NGFPfHUqA59NFzhaI_jF3qAffJTuzVj8kEH8Gr991JtJHbkSe6i_aPYpbe8opQlJ0ZmTaM0csIT6rMWuwBtR3cfH7BpnwB6QOs6MafCWOLT6eIEKFfcejLNUQNk=.png[/img] 

Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Mon Sep 29, 2014 8:51 pm
by William Bradee

I tried to put raw html in there but it is rendering. Look at the source.


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Tue Sep 30, 2014 1:37 am
by Yurii Orishchuk

Hi WIlliam,

Here is what is see when tried your public link:

http://prntscr.com/4rn1zi/direct

Is that desired result?

Regards.


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Tue Sep 30, 2014 2:04 am
by William Bradee

Sure, the code works fine per se, but when I deploy this on a web server with SSL, I get a warning from the browser that the page contains non-secure content.

My app is going to a trial. I don't want to explain this browser warning multiple times since people are so paranoid about security now.

The problem is that Appery adds an image placeholder in the DOM in the startScree.html it creates.

Here it is with "+" instead of " link with something from my project and the security warning is gone. This is a pain because I have to do it every time I update code on a web server. But less of a pain than explaining it to users.

It would be nice if Appery would add the image to the project so that it will not load an image from some random website at runtime.

And also I suspect that if someone builds phone gap, you still have this image being pulled for no particular reason, every time the app starts.


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Tue Sep 30, 2014 2:05 am
by William Bradee

This system really hates html . . . .

++ div id="startScreen_googlemap_2" dsid="googlemap_2" name="googlemap_2" data-role="appery_googlemap"
tiggzitype="object" apperytype="object" class='startScreen_googlemap_2' style='width:100%;' ++
++Imagehttp://assets1.geocommons.com/d51ab1366 ... 1311276822" rel="nofollow"http://assets1.geocommons.com/d51ab13.../a"
/++
++


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Tue Sep 30, 2014 2:08 am
by William Bradee

argh now it gobbled up the link

src=http://
assets1.geocommons.com/
d51ab1366bec6a2c4954db979e5921bd4cc140db/
images/no_preview_map.png?1311276822


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Tue Sep 30, 2014 4:26 am
by Yurii Orishchuk

william,

Do you solve this problem?

This time i've understood about what you want to do.

Try this:

Add "page load" event handler and populate it with following code:

pre

//Use here map component name.
var mapName = "googlemap_161";

Use here page name.
var pageName = "test";

jQuery("." + pageName + "_" + mapName).removeAttr("src");

/pre

Regards.


Direct insecure access to 3rd party image (geocommons.com) google map widget

Posted: Mon Oct 13, 2014 5:41 pm
by William Bradee

Thanks for your suggestion.
That may or may not work, but it still includes the URL of the image in the source, which I would like to avoid. I see in the code it just includes a phantom "img" along with the map. That's really the issue, it shouldn't (in my opinion), you should make it configurable, or it should be added to the project so it's all coming from the same domain.

Anyway, the only reason I had this is that I used a dummy page with a map to get the google apis to load. I use Javascript of my own to draw the maps.

Now I realized there's a "External Resources" tab on "App Settings" where I can add the google maps api JS (or any other library) to load. So I deleted this dummy map and I no longer have the phantom image.