Change Details

1) Visit https://translatewiki.net/wiki/Project:About (HTTPS) 2) Purge it 3) Check http://translatewiki.net/wiki/Project:About source Observed: some hotlinks of Commons files are over HTTPS. (It used to be the opposite, but it seems I can't reproduce by purging on HTTP...) Expected: $wgUseInstantCommons includes protocol-relative resources and doesn't add insecure content to secure pages. On closer inspection this is even weirder, because some resources are protocol-relative and some are not: <img alt="Torchlight kopete.png" src="https://upload.wikimedia.org/wikipedia/commons/5/57/Torchlight_kopete.png" width="135" height="135" /> but <img alt="P economy blue.png" src="/w/images/thumb/1/1a/P_economy_blue.png/135px-P_economy_blue.png" width="135" height="124" srcset="https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 1.5x, https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 2x" /> (I've no idea what "srcset" is). -------------------------- **Version**: 1.22.0 **Severity**: major **URL**: https://translatewiki.net/wiki/Thread:Support/Files_from_Commons_loading_over_HTTP **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=32219

It seems that thumbnails of remote files have absulte `srcset` URLs if the URLs in question link to the original file (th thumbnail is smaller than the original but not 2x smaller). The protocol reflects the protocol used when the page containing the thumbnail was generated. ---- 1) Visit https://translatewiki.net/wiki/Project:About (HTTPS) 2) Purge it 3) Check http://translatewiki.net/wiki/Project:About source Observed: some hotlinks of Commons files are over HTTPS. (It used to be the opposite, but it seems I can't reproduce by purging on HTTP...) Expected: $wgUseInstantCommons includes protocol-relative resources and doesn't add insecure content to secure pages. On closer inspection this is even weirder, because some resources are protocol-relative and some are not: <img alt="Torchlight kopete.png" src="https://upload.wikimedia.org/wikipedia/commons/5/57/Torchlight_kopete.png" width="135" height="135" /> but <img alt="P economy blue.png" src="/w/images/thumb/1/1a/P_economy_blue.png/135px-P_economy_blue.png" width="135" height="124" srcset="https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 1.5x, https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 2x" /> (I've no idea what "srcset" is). -------------------------- **Version**: 1.22.0 **Severity**: major **URL**: https://translatewiki.net/wiki/Thread:Support/Files_from_Commons_loading_over_HTTP **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=32219

It seems that thumbnails of remote files have absulte `srcset` URLs if the URLs in question link to the original file (th thumbnail is smaller than the original but not 2x smaller). The protocol reflects the protocol used when the page containing the thumbnail was generated. ---- 1) Visit https://translatewiki.net/wiki/Project:About (HTTPS) 2) Purge it 3) Check http://translatewiki.net/wiki/Project:About source Observed: some hotlinks of Commons files are over HTTPS. (It used to be the opposite, but it seems I can't reproduce by purging on HTTP...) Expected: $wgUseInstantCommons includes protocol-relative resources and doesn't add insecure content to secure pages. On closer inspection this is even weirder, because some resources are protocol-relative and some are not: <img alt="Torchlight kopete.png" src="https://upload.wikimedia.org/wikipedia/commons/5/57/Torchlight_kopete.png" width="135" height="135" /> but <img alt="P economy blue.png" src="/w/images/thumb/1/1a/P_economy_blue.png/135px-P_economy_blue.png" width="135" height="124" srcset="https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 1.5x, https://upload.wikimedia.org/wikipedia/commons/1/1a/P_economy_blue.png 2x" /> (I've no idea what "srcset" is). -------------------------- **Version**: 1.22.0 **Severity**: major **URL**: https://translatewiki.net/wiki/Thread:Support/Files_from_Commons_loading_over_HTTP **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=32219