Please upgrade here. These earlier versions are no longer being updated and have security issues.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Fix to Gravatar plugin for SSL
For line 75:
if(strlen(trim($_SERVER['HTTPS']))>0 || $_SERVER['SERVER_PORT']==443){
$User->Photo = 'https://secure.gravatar.com/avatar.php?'
.'gravatar_id='.md5(strtolower($Object->$Email))
.'&default='.urlencode(Asset(Gdn::Config('Plugins.Gravatar.DefaultAvatar', 'plugins/Gravatar/default.gif'), TRUE))
.'&size='.Gdn::Config('Garden.Thumbnail.Width', 40);
}else{
$User->Photo = 'http://www.gravatar.com/avatar.php?'
.'gravatar_id='.md5(strtolower($Object->$Email))
.'&default='.urlencode(Asset(Gdn::Config('Plugins.Gravatar.DefaultAvatar', 'plugins/Gravatar/default.gif'), TRUE))
.'&size='.Gdn::Config('Garden.Thumbnail.Width', 40);
}
Don't add this until http://vanillaforums.org/discussion/13533/urls-that-begin-with-https-are-treated-as-relative-paths-instead-of-absolute-paths is fixed, as this not work until urls starting with https are treated as relative paths.
if(strlen(trim($_SERVER['HTTPS']))>0 || $_SERVER['SERVER_PORT']==443){
$User->Photo = 'https://secure.gravatar.com/avatar.php?'
.'gravatar_id='.md5(strtolower($Object->$Email))
.'&default='.urlencode(Asset(Gdn::Config('Plugins.Gravatar.DefaultAvatar', 'plugins/Gravatar/default.gif'), TRUE))
.'&size='.Gdn::Config('Garden.Thumbnail.Width', 40);
}else{
$User->Photo = 'http://www.gravatar.com/avatar.php?'
.'gravatar_id='.md5(strtolower($Object->$Email))
.'&default='.urlencode(Asset(Gdn::Config('Plugins.Gravatar.DefaultAvatar', 'plugins/Gravatar/default.gif'), TRUE))
.'&size='.Gdn::Config('Garden.Thumbnail.Width', 40);
}
Don't add this until http://vanillaforums.org/discussion/13533/urls-that-begin-with-https-are-treated-as-relative-paths-instead-of-absolute-paths is fixed, as this not work until urls starting with https are treated as relative paths.
0
Comments
It's twice as helpful if we don't have to dig technical issues out of discussion comments and can keep them all in one spot. Thanks!