Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use SSL to download plugins from the Marketplace #7582

Closed
mattab opened this issue Mar 30, 2015 · 3 comments
Closed

Use SSL to download plugins from the Marketplace #7582

mattab opened this issue Mar 30, 2015 · 3 comments
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change.

Comments

@mattab
Copy link
Member

mattab commented Mar 30, 2015

The goal of this issue is to have Piwik core download plugins and themes from the Marketplace over SSL when supported.

If upgrade of plugins fail over HTTPS, over fallback to HTTP update of plugins (helping users keeping plugins up to date is vital)

Follows up: #6441, Refs #7488

@mattab mattab added Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change. c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. labels Mar 30, 2015
@mattab mattab added this to the Mid term milestone Apr 8, 2015
@SimonWaters
Copy link

Note that to do https fetches WordPress implements a copy of the Mozilla CA list.

@mattab mattab modified the milestones: Long term, Mid term Dec 5, 2016
@ziegenberg
Copy link
Contributor

I think this can be closed because Matomo already does try to use HTTPS when supported on the server-side. See

'MarketplaceEndpoint' => function (ContainerInterface $c) {
$domain = 'http://plugins.matomo.org';
$updater = $c->get('Piwik\Plugins\CoreUpdater\Updater');
if ($updater->isUpdatingOverHttps()) {
$domain = str_replace('http://', 'https://', $domain);
}
return $domain;

@bx80
Copy link
Contributor

bx80 commented Jul 7, 2022

I believe this has been now been resolved by PR #19098

@bx80 bx80 closed this as completed Jul 7, 2022
@justinvelluppillai justinvelluppillai added the not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. label Sep 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
c: Security For issues that make Matomo more secure. Please report issues through HackerOne and not in Github. not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. Task Indicates an issue is neither a feature nor a bug and it's purely a "technical" change.
Projects
None yet
Development

No branches or pull requests

5 participants