github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-02 06:25:51 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

Mixed-content issues #347

New Issue
Closed
opened 2025-11-02 03:19:26 -06:00 by GiteaMirror · 13 comments
GiteaMirror commented 2025-11-02 03:19:26 -06:00
Owner
Copy Link
Copy Source

Originally created by @minecrafter on GitHub (Feb 12, 2017).

  • Gitea version (or commit ref): 1.0.1
  • Git version: 2.7.4
  • Operating system: Ubuntu 16.04 LTS
  • Database (use [x]):
    • PostgreSQL
    • MySQL
    • SQLite
  • Can you reproduce the bug at https://try.gitea.io:
  • Log gist:

Description

Gitea can still serve mixed-content pages, even with SSL. This is most pronounced with images being loaded over an insecure connection.

This can be solved by integrating a solution similar to camo (GitHub uses this) into Gitea.

In addition to security, it also provides a privacy benefit for users if the install is public.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

Originally created by @minecrafter on GitHub (Feb 12, 2017). - Gitea version (or commit ref): 1.0.1 - Git version: 2.7.4 - Operating system: Ubuntu 16.04 LTS - Database (use `[x]`): - [ ] PostgreSQL - [ ] MySQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL): https://try.gitea.io/gitea/gitea - [ ] No - [ ] Not relevant - Log gist: ## Description Gitea can still serve mixed-content pages, even with SSL. This is most pronounced with images being loaded over an insecure connection. This can be solved by integrating a solution similar to [camo](https://github.com/atmos/camo) (GitHub uses this) into Gitea. In addition to security, it also provides a privacy benefit for users if the install is public. <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/41956301-mixed-content-issues?utm_campaign=plugin&utm_content=tracker%2F47456670&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F47456670&utm_medium=issues&utm_source=github). </bountysource-plugin>
GiteaMirror added the type/enhancementtopic/security labels 2025-11-02 03:19:26 -06:00
GiteaMirror commented 2025-11-02 03:19:27 -06:00
Author
Owner
Copy Link
Copy Source

@thehowl commented on GitHub (Feb 13, 2017):

If we're embedding a camo server into gitea, I'd like to say go-camo is a thing and we could get most stuff from that: https://github.com/cactus/go-camo

@thehowl commented on GitHub (Feb 13, 2017): If we're embedding a camo server into gitea, I'd like to say go-camo is a thing and we could get most stuff from that: https://github.com/cactus/go-camo
GiteaMirror commented 2025-11-02 03:19:28 -06:00
Author
Owner
Copy Link
Copy Source

@tboerger commented on GitHub (Feb 13, 2017):

go-camo makes sense, we don't want to reinvent the wheel

@tboerger commented on GitHub (Feb 13, 2017): go-camo makes sense, we don't want to reinvent the wheel
GiteaMirror commented 2025-11-02 03:19:28 -06:00
Author
Owner
Copy Link
Copy Source

@lunny commented on GitHub (Feb 21, 2017):

Anyone would like to send a PR to fix this?

@lunny commented on GitHub (Feb 21, 2017): Anyone would like to send a PR to fix this?
GiteaMirror commented 2025-11-02 03:19:28 -06:00
Author
Owner
Copy Link
Copy Source

@lunny commented on GitHub (Feb 22, 2017):

Move this to v1.2 since no PR to send.

@lunny commented on GitHub (Feb 22, 2017): Move this to v1.2 since no PR to send.
GiteaMirror commented 2025-11-02 03:19:28 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 27, 2019):

is there any progress?

@6543 commented on GitHub (Jul 27, 2019): is there any progress?
GiteaMirror commented 2025-11-02 03:19:28 -06:00
Author
Owner
Copy Link
Copy Source

@lunny commented on GitHub (Jul 27, 2019):

Nobody are working on this.

@lunny commented on GitHub (Jul 27, 2019): Nobody are working on this.
GiteaMirror commented 2025-11-02 03:19:29 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 27, 2019):

@lunny
can we do this onto 1.10.0?
i think it only afects the markdown parts of gitea?
which files are these so i'll have a look at it

and mean lable kind/securety also privacy ?
because i think this is also a privacy concerne ...

@6543 commented on GitHub (Jul 27, 2019): @lunny can we do this onto 1.10.0? i think it only afects the markdown parts of gitea? which files are these so i'll have a look at it and mean lable kind/securety also privacy ? because i think this is also a privacy concerne ...
GiteaMirror commented 2025-11-02 03:19:29 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 27, 2019):

to discust:

should we replace the src url of img nodes after blackfriday process the markdown

or

replace ![*]($url) with ![*]($camourl/$url) ?

@6543 commented on GitHub (Jul 27, 2019): # to discust: should we replace the src url of img nodes after blackfriday process the markdown or replace` ![*]($url)` with `![*]($camourl/$url)` ?
GiteaMirror commented 2025-11-02 03:19:30 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 27, 2019):

we ned in each case two config values

  • CAMO_URL
  • CAMO_KEY

for example:
nginx reverse proxy gitea.com/camo -> http://127.0.0.1:3456

camo itself:
./go-camo -k 123secret --listen=127.0.0.1:3456 --stats --metrics &

@6543 commented on GitHub (Jul 27, 2019): we ned in each case two config values * CAMO_URL * CAMO_KEY for example: nginx reverse proxy gitea.com/camo -> http://127.0.0.1:3456 * CAMO_URL = https://gitea.com/camo * CAMO_KEY = 123secret camo itself: `./go-camo -k 123secret --listen=127.0.0.1:3456 --stats --metrics &`
GiteaMirror commented 2025-11-02 03:19:30 -06:00
Author
Owner
Copy Link
Copy Source

@tboerger commented on GitHub (Jul 28, 2019):

I think the goal had been to embed it instead of relying on another service

@tboerger commented on GitHub (Jul 28, 2019): I think the goal had been to embed it instead of relying on another service
GiteaMirror commented 2025-11-02 03:19:30 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 28, 2019):

We can use the routines of go-camo it shouldnt be that hard

I already play with the url encode function provided by this project but sinse i just starded with go i have no idear how to integrate the main camo prosess into gitea jet

@6543 commented on GitHub (Jul 28, 2019): We can use the routines of go-camo it shouldnt be that hard I already play with the url encode function provided by this project but sinse i just starded with go i have no idear how to integrate the main camo prosess into gitea jet
GiteaMirror commented 2025-11-02 03:19:30 -06:00
Author
Owner
Copy Link
Copy Source

@6543 commented on GitHub (Jul 28, 2019):

I think the goal had been to embed it instead of relying on another service

and then https://github.com/go-gitea/gitea/issues/916#issuecomment-515718697 still remains

@6543 commented on GitHub (Jul 28, 2019): > I think the goal had been to embed it instead of relying on another service and then https://github.com/go-gitea/gitea/issues/916#issuecomment-515718697 still remains
GiteaMirror commented 2025-11-02 03:19:31 -06:00
Author
Owner
Copy Link
Copy Source

@lhinderberger commented on GitHub (Sep 7, 2020):

There has been a parallel discussion on this issue at Codeberg.org: https://codeberg.org/Codeberg/Community/issues/196

@lhinderberger commented on GitHub (Sep 7, 2020): There has been a parallel discussion on this issue at Codeberg.org: https://codeberg.org/Codeberg/Community/issues/196
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No labels topic/security type/enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#347