2 issues when importing bookmarks with a "file:///" type URL from Firefox

[znoteer]

When I imported my bookmarks from Firefox, two unexpected things happened when the URL was of the "file:///" type.

First, each bookmark with a file:/// URL was imported twice. That is, I ended up with two identical shaares for each file:/// URL.

Second, URL's were converted from file to http type. For example, a FF bookmark with the URL file:///home/znoteer had its URL converted to http:///home/znoteer in the URL field of the shaare upon import. Clicking a shaare thusly converted leads to the error message "Server not found. We can't connect to the server at home. Did you mean to go to www.home.com/znoteer?" from Firefox.

[znoteer]

New detail: it is impossible to change http:/// to file:/// in the URL field of a shaare. It gets automatically reset to http upon saving.

[ArthurHoaro]

@znoteer Can you make sure that file is included in the list of allowed protocols in your Shaarli configuration security.allowed_protocols?

[znoteer]

@ArthurHoaro What file is that setting in? On the ui I looked in all of "Configure your Shaarli", "Plugin admin" and "Server Admin" under the Tools menu but couldn't find such a setting. I've also looked in a couple of files such as /etc/apache2/conf-enabled/shaarli and /etc/plinth/modules-enabled/shaarli.

[nodiscc]

It's in config.json.php in the shaarli data directory (in the Debian/FreedomBox packaging that appears to be /var/lib/shaarli/data)

...
    },
    "security": {
        "ban_after": 4,
        "ban_duration": 1800,
        "session_protection_disabled": false,
        "open_shaarli": false,
        "allowed_protocols": [
            "ftp",
            "ftps",
            "magnet"
        ],
        "markdown_escape": true
    },
    "dev": {
        "debug": false
    },
    "general": {
...

You need to add file to the allowed_protocols list.

[znoteer]

Thanks, I don't think I'd've found that file on my own very quickly.

After restarting php and apache2 (actually, I don't know if that was necessary, but I restarted them both anyway before trying) that seems to work partially. That is to say, the change to "file" is successfully saved, but the links don't work directly.

For example, I have a shaare file:///home/znoteer/tmp/tmp.htm. When it was still http:///home/znoteer/tmp/tmp.htm, I could click on the link and the browser would dutifully try to find the non-fqdn "home" which of course fails. Now that the link is changed to "file", however, nothing happens when I click on the link. I can open the link in a new tab by right-clicking on the link and making the appropriate selection in the menu that appears. But, even that doesn't directly open the page.

Instead it loads nothing. The opened tab is blank, even though "file:///home/znoteer/tmp/tmp.htm" has been filled in the location field. I can see that it hasn't loaded anything because the "reload page" button is greyed out. If I put the cursor in the location field and press the "Enter" key, the file loads and the "reload" button becomes active.

A tangentially related question that you needn't feel obliged to answer: I added "file" to the list "ftp", ftps", "magnet". There is no "http" nor "https" protocol in that list. How come http and https shaares can be saved without being in the list?

Thanks.

[cy7yz2rj]

the links don't work directly

That's a browser security feature, please see #1515 (comment)

[ArthurHoaro]

A tangentially related question that you needn't feel obliged to answer: I added "file" to the list "ftp", ftps", "magnet". There is no "http" nor "https" protocol in that list. How come http and https shaares can be saved without being in the list?

HTTP and HTTPS are enabled by default because it's the purpose of Shaarli, to save HTTP links. Also, when a non-allowed protocol is found, or when none is provided, it will be replaced with the default one - http://.
It could probably be replaced with https:// instead, thinking about it.

[znoteer]

@cy7yz2rj Thanks for the link. That feature makes sense. I don't think I'll work around it.

@ArthurHoaro Right. Now that you've said it, it kind of goes without saying. Thanks.

Also, given trends toward "encrypt all the things" and my own penchant for privacy, I would tend to favour the default being made https rather than http. But I also think it might be useful to more people than just cy7yz2rj and myself to include "file" in the default list. That way, there is no need to worry about whether it gets converted to http or to https

[nodiscc]

PR #1937 (update documentation to mention file:/// URIs).

include "file" in the default list.

I don't think it should be included, as browsers don't allow file:/// links to be followed from a non-local webpages, for good reasons, so this would be broken by default. I don't recommend disabling this browser security feature as it would allow malicious webpages/scripts globally to read local files on the client. So mentioning file URIs in the documentation should be enough.