libregraphicsmeeting.org gets an F rating and 0/100 score at the Mozilla Observatory HTTPS evaluation

[schumaml]

See https://observatory.mozilla.org/analyze/www.libregraphicsmeeting.org

Also, when forcing HTTPS, browsers warn about mixed content (likely images and/or scripts, I didn't check any details).

Defaulting to HTTPS and having no mixed content warnings could be a reasonable first goal for the libregraphics website, going further can be done step by step is necessary.

Feel free to ask if you have any questions, we did this for gimp.org and have likely hit any pitfalls for this process along the way :)

[ms-studio]

The website already has a valid certificate, as seen when visiting a static resource: https://libregraphicsmeeting.org/2018/wp/wp-content/themes/lgm2018/img/logo-lgm--web.svg

So the only thing to do is: a person with admin access to the current site must log into the WordPress admin interface, and change the site URL from http://libregraphicsmeeting.org to https://libregraphicsmeeting.org

[aoloe]

thanks @ms-studio !

i've done the change you suggested and also forced the https redirection in the .htaccess.

@schumaml it's all good now or should i make other changes? the mozilla reports other "issues"... is there any you want to see fixed?

[ms-studio]

@aoloe there are two ressources still loading as http:// : it's two image links inside the footer widgets. this should be changed directly in the code:

<aside class="widget-area" role="complementary">
--
  | <div class="widget-column footer-widget-1">
  | <section id="text-2" class="widget widget_text"><h2 class="widget-title">Sponsors</h2>			<div class="textwidget"><p><img src="http://libregraphicsmeeting.org/2018/wp/wp-content/uploads/2018/03/logo-google-fonts.png" width="200" height="37" /></p>
  | </div>
  | </section>			</div>
  | <div class="widget-column footer-widget-2">
  | <section id="text-5" class="widget widget_text"><h2 class="widget-title">Co-organized by</h2>			<div class="textwidget"><p><img class="alignnone size-medium wp-image-348" src="http://libregraphicsmeeting.org/2018/wp/wp-content/uploads/2018/03/logo_compoliticas_completo-300x71.jpeg" alt="" width="300" height="71" /></p>

[aoloe]

let's see if i can find where they are defined...

[aoloe]

ok, it was in a widget...

fixed...

anything else? : - )

[schumaml]

Nice to see this being addresses so fast :)

Let's take one step at a time, as fulfilling some of the checks can get quite involved if a CMS is being used.

[schumaml]

So one redirection has to be fixed:

http://www.libregraphicsmeeting.org currently redirects to https://libregraphicsmeeting.org

It should be

http://www.libregraphicsmeeting.org -> https://www.libregraphicsmeeting.org -> https://libregraphicsmeeting.org

to not interfere with HSTS later.

[schumaml]

The threee last checks - the X-* stuff - should also be rather easy to add, as it is only additional HTTP headers which prevent content type guessing by browsers, framing of libregraphicsmeeting.org by other sites, and some cross-site scripting attacks.

[schumaml]

The Content Security Policy check will be the hardest, as deploying useful strict CSPs will kill inline javascript and inline css (i.e. style tags), and should be the last steps if it is attempted at all.

[aoloe]

i've now edited the .htaccess as following:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteRule ^$ /2018 [R=302,L]

is it better now?

[aoloe]

i've added:

    $headers['strict-transport-security'] = 'max-age=31536000; includeSubDomains';
    $headers['Content-Security-Policy'] = 'default-src https:; script-src \'self\' \'unsafe-inline\'';
    $headers['X-Frame-Options'] = 'SAMEORIGIN';
    $headers['X-XSS-Protection'] = '1; mode=block';
    $headers['X-Content-Type-Options'] = 'X-Content-Type-Options: nosniff';
    $headers['Referrer-Policy'] = 'strict-origin';

but now i get a few errors in the console. any hint how to get rid of them?

[schumaml]

With a CSP in place, you have to pay attention to the following:

• all javascript should be in .js files, nothing in <script> elements in an html document
• all style rules should be in .css files, nothing in <style> elements inside html documents

Not sure how easy or hard this is with Wordpress and its modules, whose authors might not have designed them with these consideration in mind (NB: I do no next to nothing about Wordpress, though).

[schumaml]

BTW, for the

X-Content-Type-Options

the value is supposed to just be just "nosniff"

And congrats - from F to B in no time at all :)

[aoloe]

i've fixed the nosniff... but what i've noticed: we've lost the map on https://libregraphicsmeeting.org/2018/2018-edition/

now, i've disabled

$headers['Content-Security-Policy'] = 'default-src https:; script-src \'self\' \'unsafe-inline\'';

no idea how to write in a way that it's generally safe and allows us to load the osm map at the end of

https://libregraphicsmeeting.org/2018/2018-edition/

for now, it's more important to have the map shown.

[schumaml]

Yes, the CSP can be quite involved - we broke stuff on gimp.org in quite interesting ways, some going unnoticed for quite some time, like inline styles in SVG files getting killed (Inkscape should really allow for fully external styling [or does it now?])

CSPs force you to evaluate where your resources come from and how they are loaded, and possibly change this - definitely not something that should be done one day before the conference starts :)

[patdavid]

I’m willing to help audit and hack on this if needed.

On Wed, Apr 25, 2018 at 11:47 AM Michael Schumacher < ***@***.***> wrote: Yes, the CSP can be quite involved - we broke stuff on gimp.org in quite interesting ways, some going unnoticed for quite some time, like inline styles in SVG files getting killed (Inkscape should really allow for fully external styling [or does it now?]) CSPs force you to evaluate where your resources come from and how they are loaded, and possibly change this - definitely not something that should be done one day before the conference starts :) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#46 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACpnMPNdDWoYu15ApoUi35W4U1gFgn8Zks5tsKixgaJpZM4TfdZZ> .

-- https://patdavid.net GPG: 66D1 7CA6 8088 4874 946D 18BD 67C7 6219 89E9 57AC

[aoloe]

hi @patdavid you should be able to do it, by setting up a local wordpress and use the theme in

https://github.com/libregraphicsmeeting/htdocs-2018

the repository's README file summarizes most steps involved.

i can give you push rights to the repository and the changes are automatically deployed to the site.