Found a bug in fb_canvas.module when dealing with SSL and Non-SSL access [#1132406]

Line 403-405 of fb_canvas.module has this:

    // Make relative links point to canvas pages.
    $patterns[] = "|<a([^>]*)href=\"{$base}|";
    $replacements[] = "<a $1 href=\"http://apps.facebook.com/{$_fb_app->canvas}/";

The hardcorded http in the replacement pattern will break your app if being accessed from https://apps.facebook.com/

I'm working on a cleaner solution/patch, but I'm testing this right now:

    // Make relative links point to canvas pages.
    $patterns[] = "|<a([^>]*)href=\"{$base}|";
    if($_SERVER['HTTPS']) {
      $replacements[] = "<a $1 href=\"https://apps.facebook.com/{$_fb_app->canvas}/";
    } else {
      $replacements[] = "<a $1 href=\"http://apps.facebook.com/{$_fb_app->canvas}/";
    }

It's ugly as sin, but it seems to be solving the issue for me.

Comment	File	Size	Author
#3	fb_protocol.diff	3.32 KB	Dave Cohen

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

Dave Cohen CreditAttribution: Dave Cohen commented 20 April 2011 at 18:05

Issue tags:

+fb3-blocker

Good catch. There's some code in facebook's php sdk that does a test like this...

    $protocol = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on'
      ? 'https://'
      : 'http://';

Comment #2

MacRonin CreditAttribution: MacRonin commented 15 June 2011 at 21:27

Thanks for catching. I was just doing some testing(learning Canvas pages) and getting similar error. (I have HTTPS set as my user's default.)

For most apps it just gives me a warning and asks to temporarily switch to unsecured HTTP. But for my server i can accept either HTTP or HTTPS and route to the same page, so avoiding the warning msg and following switch from HTTPS to HTTP would be great.

BTW I'm on the current DEV version for Drupal - 7