Printable View
Hey guys, may I suggest that you use https for the PE site? You can get a free certificate from Let's Encrypt (which is backed by just about every major web org), that's very easy to install and setup. I can help if you need it.
https://letsencrypt.org/
Nothing, guys?
Sorry - not (deliberately ;)) ignoring you - I'll get onto this shortly.
Bear in mind that an SSL would have had NO impact on the hack we had a few weeks ago.
But since we're typing a lot here, SSL would be good.. and free: https://letsencrypt.org/
Got forced to change my password by vBulletin this morning. I had been waiting to "upgrade" to a stronger password once I knew for certain PE was secure.
How are things looking on that front?
I suspect crickets chirping :rollQuote:
Originally Posted by battema
Yep, never hurts to ask tho :up
It's not like PE is Duncan's day job. It can wait.
Duncan is overseas for the next few weeks.
Yep, no instant worries :up Just thought I'd ask since the reset reminded me.
As much as I appreciate the work involved (running my own sites), however Let's Encrypt is not only free, but takes minutes to set up. It's so easy, and protects all of us.Quote:
Originally Posted by Jerjo
*bump*
just fyi, but google chrome goes SSL by default on 7/24; PE doesn't load properly over SSL.
The problem here is not all the elements are secure and the non-secure elements are being dropped by the browser.Quote:
Originally Posted by strawberrybrick
I recently converted progforums.com to SSL and used PHP code in the forum header to re-write the address bar to the https version of any page. This can also be achieved in the .htaccess file on Apache systems.
One problem is, if one of your users links, for example, an image on a remote site that is not secure, the browser will report that the page security is broken and the image won't appear (or in IE, it'll ask you if you want to display the non-secure items). I was able to use the forum's censoring rules to convert some known addresses to https - for example I have a rule that converts http://www.progforums.com to https://www.progforums.com. This saved me having to find them all and correct them manually!
Of course, you can't simply convert all http:// to https:// because you can't guarantee any particular remote site is secure.
It is a bit of a can of worms, unfortunately ;)
On my sites, urls are written //www.whatever.com/ and the code appends the rest. I know it's worms, but there's no other way forward.
Well with forum software, its usually a case of changing a base URL somewhere in the database, but then you need to make sure anyone hitting the site from the old URL gets redirected to the secure version. This also helps search engines find your site and stops them thinking your site is duplicated.
As I said, I did this in the php file that generates the header of each page and I assume a similar thing could be done to a vBulletin site.
If I was going to do it here, my code would be something like this:
This will ensure any incoming URL that doesn't match www.progressiveears.org or is not https gets rewritten.Code:$redirect = false;
$path = $_SERVER['REQUEST_URI'];
$url = $_SERVER['HTTP_HOST'];
if ($url != 'www.progressiveears.org') {
$redirect = true;
}
$SSL_test = $_SERVER['HTTPS'];
if ($SSL_test != true) {
$redirect = true;
}
if ($redirect==true){
header('HTTP/1.1 301 Moved Permanently');
header('Location: https://www.progressiveears.org' .$path);
}
I run Apache, and use .htaccess to redirect to ssl/https.
Did you notice, well did you?
Not all the way there, but something.
sssssssssssssssssss ;)Quote:
Originally Posted by markwoll
Good job!
:up
"Not all the way there" will be fixed shortly.
Yesterday or the day before? I noticed a diff...