On a site using SSL, I am getting the following warning:

[the page] "was loaded over HTTPS, but ran insecure content from 'http://mirrors.creativecommons.org/presskit/cc-icons.ttf': this content should also be loaded over HTTPS."

From what I can tell, the fonts are not available securely. Is it possible to just include the icon fonts with the module, rather than hard-coding a link to a third-party website?

Comments

juliakoelsch’s picture

Status: Active » Closed (duplicate)

Looks like it's already been solved in the dev version: https://www.drupal.org/node/2207867

Thanks!

juliakoelsch’s picture

Status: Closed (duplicate) » Active

Actually, this is not fixed in dev and is still an issue, due to the commit in https://www.drupal.org/node/2220721 that reversed the inclusion of the font and re-introduced hard-coding the non-secure third-party URL.

Is the license issue resolved? If not, and the fonts cannot be hosted securely, can the fonts be omitted entirely?

lolandese’s picture

Hi Julia,

Is the license issue resolved?

No. The license is still CC4 that is not GPL compatible like CC0.

If not, and the fonts cannot be hosted securely, can the fonts be omitted entirely?

Well. You could host the font securely on your own server. It is still Creative Commons licensed, thus intended to be shared. It cannot be included in the module on D.O. only because this license isn't GPL compatible.

Besides reminding Creative Commons about the open licensing issue, we made an additional request to make the font available under HTTPS.

To omit the fonts:
I suppose at admin/config/media/flickr you've found the checkbox to deselect to exclude the license info in caption. When you enlarge the image still the full text version will be used (a little bit below the aforementioned checkbox). To have other icons, you should hack the code. Feel free to add a paragraph to the Troubleshooting page describing:

  • in what circumstances a local copy of the cc-icons font is needed
  • where the font can be downloaded
  • in what folder it should be placed
  • how the module code should be altered to make use of the local copy.

In any case, thanks for reporting. It led to a useful additional request to Creative Commons.

msemenov’s picture

I think you should click checkbox to exclude Flickr.css in case license is already unchecked

lolandese’s picture

Issue tags: -#security
Related issues: +#2308099: Conflict with respond.js on IE8

While not directly related, the patch in review at #2308099: Conflict with respond.js on IE8 might be useful for some visiting this issue that use respond.js.

In flickr.css, there is a call to a font-face within a media query. This is something respond.js absolutely hates - it doesn't render improperly, we're not talking about graceful degradation. IE8 goes into a 'perma loading' state, and crashes. The provided patch removes the media query and doesn't change anything to the site, except that the font will be used for printing as well, which is actually better.

lolandese’s picture

lolandese’s picture

Version: 7.x-1.6 » 7.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new1.75 KB

Attached patch:

juliakoelsch’s picture

Thanks so much! The patch applies cleanly and works as advertised.

lolandese’s picture

Status: Needs review » Reviewed & tested by the community

Good! That sounds like an RTBC to me.

lolandese’s picture

Status: Reviewed & tested by the community » Fixed

  • lolandese committed 6612271 on 7.x-1.x
    Issue #2334425 by Spry_Julia: Using an HTTPS resource for the CC-icons...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

webservant316’s picture

I used drush dl flickr --dev and that gets this commit, however, the dev from the flickr homepage does not include the patch.

?

webservant316’s picture

actually when IE8 tries to load https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.ttf it hangs?

reopening ticket.

webservant316’s picture

Status: Closed (fixed) » Needs work
webservant316’s picture

ok. I am getting random results on IE8. Sometimes my webpage will display and other times it is hung up while trying to read this resource https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.ttf it hangs? If I stop and start the page load or close the tab and open a new tab sometimes the page will load. Is this a problem with the module code and this patch or with my browser cache? I have cleared my IE8 browser cache multiple times.

lolandese’s picture

Status: Needs work » Needs review
StatusFileSize
new3.19 KB

You are right. See http://css-tricks.com/snippets/css/using-font-face/.

Luckily we have the other required font formats available from https://cdnjs.com/libraries/cc-icons#.

Thanks for reporting.

P.S.: I checked both the tar and zip dev version from the project page, but the last commit from this issue is included (using https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.ttf).

webservant316’s picture

the patch applied cleanly, however, still getting intermittent results. the page load sometimes, but hangs the next time while trying to download from https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.eot....

I am not even sure why I need this font business. can you give me instructions on how to bypass all this? I prefer less load on my website.

a related point of concern. the page that evidenced the problem was not even a flickr page but instead my home page view. there is also no flickr pages in the view. so why is flickr even present for the page load? I am concerned that flickr is creating unneeded weight by fully loading itself on every page. how much weight does that add?

I am using flickr as a text format filter so that I can display galleries. perhaps that is why flickr loads itself fully on every page? I see it would be too much work to determine if a text format on the page needed the flickr filter.

I would like to instead use a flickr field, but I think that galleries do not yet work on the flickr field. See https://www.drupal.org/node/2347101. If flickr fields worked for galleries would flickr then only load itself on the pages with a flickr field?

lolandese’s picture

Just to clarify. The CC-icon font is used to provide license info in the caption of an image in a compact way. By default it is turned off, but present in flickr.css. That is loaded one time on the client side (the site visitor's) where it is stored in the browser cache to speed up other page visits on the same domain. That answers one of your questions; it is not loaded on every page, but just the first one that gets visited.

The page loads sometimes, but hangs the next time while trying to download from https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.eot....

Can you try to specify "hangs" in more detail? Might this be a server problem? Where is the site hosted?

Can you give me instructions on how to bypass all this?

In admin/config/media/flickr do you have License info in caption unselected?
You also have a checkbox Use flickr.css. Uncheck to take care of the styling yourself in custom CSS.
You could host the icon font locally. I comprehend you wouldn't feel doing that if you are not even using license info in the caption. The attached patch:

  • adds the other needed font types to provide browser compatibility (it includes the previous patch, git clone again a new version, then apply)
  • extracts all cc-icons related CSS and puts it in a separate file, to be used only if license info in the caption is set to be shown
  • uses //cdn.jsdelivr.net/cc-icons/1.2.0/fonts/ as the source instead of //cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/...

Let me know if this solves your issue, with and without using license info in the image caption.

Thanks.

lolandese’s picture

Use this patch instead. It contains the necessary new CSS file flickr_cc_icons.css.

lolandese’s picture

webservant316’s picture

The patch in #20 installs cleanly and works for me on IE8. Thanks!
Nice, idea with the conditional include of flickr_cc_icons.css.

Can you try to specify "hangs" in more detail?

The initial load of the website would begin to load the first page and simply stop. The browser status bar would indicate that it was waiting for https://cdnjs.cloudflare.com/ajax/libs/cc-icons/1.2.0/fonts/cc-icons.eot.... to finish downloading... or something. However, the conditional include of this css based on the license checkbox now enables me to exclude this resource that I do not even need.

In admin/config/media/flickr do you have License info in caption unselected?

I did have it unselected, but now with your new patch the license CSS is never included.

Now back to my last question to you.

I would like to instead use a Flickr field instead of Flickr filter. I like the easier node edit interface for my end user. I have tried display type "Embedded Flickr.com Slideshow (Flash)" and "(Non Flash)", but get nothing on the page with those options. Do I need to set something up for that to work? What am I doing wrong? Is this the issue for me to watch? https://www.drupal.org/node/2347101. I can get the other Flickr Field display types to display the primary image linked to the Flickr gallery, but I want to display the gallery on my website.

lolandese’s picture

I also changed the resource for the icon font. Could you check for me what happens if you select 'License info in caption' now? I just want to know if using the other resource has impact on this or not.

I would like to instead use a Flickr field instead of Flickr filter.

We don't use Flickr Field ourselves. We maintain it, but obviously it doesn't get the same attention as the rest of the module (for now). Did you consider to create a block with a text field that contains Flickr Filter. That adds some flexibility for placement. I don't know your use case.

I have tried display type "Embedded Flickr.com Slideshow (Flash)" and "(Non Flash)", but get nothing on the page with those options. Do I need to set something up for that to work?

No. Open a new issue and try to give the steps to replicate it in the sandbox. The other issue seems unrelated to me.

I can get the other Flickr Field display types to display the primary image linked to the Flickr gallery, but I want to display the gallery on my website.

It might be you didn't enable the sub-module Flickr Sets? It seems similar of what is described at https://www.drupal.org/node/2226579#disable. For a set to display multiple images alongside each other you should use the Flickr Field 'photo' with 'Item Type': 'Photoset' (the Flickr Sets module must be enabled). It's slightly confusing having two field types that are both able to display a set. I know.

webservant316’s picture

I also changed the resource for the icon font. Could you check for me what happens if you select 'License info in caption' now? I just want to know if using the other resource has impact on this or not.

I turned on the license checkbox and it worked fine in IE8 as well. Congrats.

I will open new tickets for the other issues.

Thanks again.

lolandese’s picture

Status: Needs review » Reviewed & tested by the community

Good. I guess we can set this RTBC then.

Thanks for reporting.

webservant316’s picture

yep

  • lolandese committed bb3c1d4 on 7.x-1.x
    Issue #2334425 by Spry_Julia: Cross-browser compatibility for the...
lolandese’s picture

Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.