When using the search on secure websites (https), many browsers do not display results. In 7.x-2.1, this is caused by downloading the show_afs_search.js file from Google.com. Even though Google is pushing people to https, their script is hard wired for http. Thus browser security often hides the "insecure" results.

CommentFileSizeAuthor
#8 https-support-2580513-7-8.patch588 bytesafinnarn
#6 google_cse-https_support-2580513-6.patch1.51 KBmohit_aghera
#5 google_cse-https_support-2580513-5.patch1.3 KBdenix
#2 google_cse-https_support-2580513-2-D7.patch587 byteskwfinken

Comments

kwfinken created an issue. See original summary.

kwfinken’s picture

kwfinken commented
StatusFileSize
new google_cse-https_support-2580513-2-D7.patch587 bytes

Patch 2 modifies the downloaded afs code to be schemeless before including it on the page. I know this is a kludge, but it works for anyone needing google search on HTTPS.

Ambroos’s picture

Ambroos commented

I'd even go as far as always using the HTTPS version, as there is no downside to it in terms of speed/security/compatibility. HTTPS is the way forward and should be used whenever possible.
Read more: http://www.paulirish.com/2010/the-protocol-relative-url/

bgm’s picture

bgm commented

I think this was resolved by #2422979: Integrate V2 code ?

See also: #2072029: Search results not showing when browsing over HTTPS

I'm using this module on an https-only site, and the latest version of the module works well (7.x-2.4).

denix’s picture

denix commented
Version: 7.x-2.1 » 7.x-2.4
Status: Active » Needs review
Issue tags: +https
StatusFileSize
new google_cse-https_support-2580513-5.patch1.3 KB

Hi @bgm unfortunately it does not seems to be solved. I am in a http/https website and Chrome keep complaining about my Certificate, because of the mixed content with the message:

...over a secure connection, but contains a form which targets an insecure endpoint 'http://www.google.com/cse'. This endpoint should be made available over a secure connection...

However the fix is simple, I attach here a 2 lines patch that will move the form to pure HTTPS.
Best,

Denis

mohit_aghera’s picture

mohit_aghera commented
Version: 7.x-2.4 » 7.x-1.x-dev
StatusFileSize
new google_cse-https_support-2580513-6.patch1.51 KB

Re-rolling patch for 7.x-1.x branch.

denix’s picture

denix commented
Version: 7.x-1.x-dev » 7.x-2.4

Hi @mohit_aghera, I move back to branch 2.x as branch 1 is not supported. However, many thanks for your back port! I hope this will be included in next release.

afinnarn’s picture

afinnarn commented
StatusFileSize
new https-support-2580513-7-8.patch588 bytes

Funny story about the noscript link in the previous patches...When you have JS off you can't even load the results on Google-hosted search, at least that's what happened for me. I spent some time fixing another issue regarding that tag only to click the link and get another noscript tag, lolz. That was a knee-slapper.

So I removed the change to the noscript tag code and set the action link to protocol relative. We can't punish people if they don't have a secure site, and I think protocol relative is the best compromise.

As for patch #2, I can't find where that code is in the module. The patch is malformed and has no file names. On a quick search, I couldn't find the code either.

Whoever had the issue, can you please test this patch and then we can merge in if it works? I'm not sure I know the specific issue people are seeing.

  • afinnarn committed 92d2733 on 7.x-2.x 
    Issue #2580513 by kwfinken, denix, mohit_aghera, afinnarn: HTTPS Support
afinnarn’s picture

afinnarn commented
Version: 7.x-2.4 » 7.x-2.x-dev
Status: Needs review » Fixed

Thanks all!

  • afinnarn committed 92d2733 on 7.x-3.x 
    Issue #2580513 by kwfinken, denix, mohit_aghera, afinnarn: HTTPS Support
afinnarn’s picture

afinnarn commented
Status: Fixed » Closed (fixed)