Bug 791681 - Insecure transition from HTTP to HTTPS in form post

[kyoshino]

No description provided.

[jpetto]

There should be a check for localhost/debug servers somewhere in here. Local installations without SSL need to be able to test form submissions.

[openjck]

Notes from our meeting: It might be best to squash these commits into one. The HTML changes look safe, but we might want to pay special attention to the misc.py changes.

[dpoirier]

PEP-8: "Don't use spaces around the = sign when used to indicate a keyword argument or a default parameter value."

[kyoshino]

Rebased and removed spaces around the = sign for a default parameter as per @dpoirier's comment.

[pmclanahan]

This is looking good, but the new secure_url() function needs some tests.

[jpetto]

Just a note to self (and @alexgibson for good measure) - will need to fix AJAX call here after merge:

https://github.com/mozilla/bedrock/blob/master/media/js/firefox/os/desktop.js#L214

[kyoshino]

Will try to write tests in test_helper_misc.py and fix the Ajax code.

[jpetto]

The fix for the AJAX call should be very simple. I believe line 214 (https://github.com/mozilla/bedrock/blob/master/media/js/firefox/os/desktop.js#L214) will need to look like:

url: $form.attr('action'),

[kyoshino]

Yeah, $form.attr('action') will be a full URL by using the secure_url() function.

[kyoshino]

Added tests and fixed the Ajax call.

[jpetto]

To more closely mimic a production environment, I think we should have this return ctx['request'].build_absolute_uri(path). This will give us a fully qualified URL locally instead of a possible empty string.

[kyoshino]

Will fix it later.

[jpetto]

Aside from my previous comment, this looks like an r+. After that (hopefully) final change, need to test on a demo server before merging.

[kyoshino]

Fixed the secure_url function (and tests) to output a full URL on a dev site also.

[jpetto]

This is up on demo1, and all seems to be well. Tested most all of the pages affected and am seeing no ill effects.

@pmac and/or @sgarrity - care to give a demo1 a run through?

[jpetto]

r+!