Is there any way to "exclude" certain paths from any kind of SSL switching at all?
For example, what if I want BOTH paths below to work without redirecting?
http://mysite/mypath
https://mysite/mypath
It seems that the two hooks that are provided with the module only allow you to select whether it should redirect to HTTP or whether it should redirect to HTTPS, but it doesn't give you the ability to NOT redirect at all. Right?
The reason I need this, is I am using AJAX to automatically populate a block of text on my site to tell the user how many items are in their cart. Ajax is used to avoid caching. In HTTP, this works fine, but it stops working in HTTPS, because UC_SSL is automatically redirecting to the HTTP version.
This seems like it wouldn't be a hard feature to add. A third hook could be provided called hook_exclude_ssl_switch_paths(), that returns a list of paths that should NOT cause an automatic redirect to the HTTP/HTTPS alternative.
Make sense?
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | hook_exclude_ssl_switch_paths-1354068-1.patch | 2.48 KB | m.stenta |
Comments
Comment #1
m.stentaAttached is a patch that does this. Please review.
Comment #2
m.stentaSwitching status to "needs review".
Comment #3
Shai commentedThis sounds really useful. I'll try it on the site I'm working on now.
Comment #4
crystaldawn commentedThere is already an exclude path hook. The current hook excludes from any switching at all. If you are in SSL mode, these hooks are ignored. If you are in Mixed SSL mode, then any links in the current exclude path simply wont do anything (in otherwords they would always be https). Not sure what this extra hook is for since it seems to do the same exact thing.
Comment #5
m.stentaI haven't looked at this in a while, but I don't think that's correct.
Using the current hook_exclude_ssl_paths() forces those paths to non-SSL. Take a look at line 253 of uc_ssl.module. It is redirecting excluded URLs to their non-SSL equivalents...
The patch I provided adds a little code right before the two possible redirects (to SSL or to non-SSL) and says "hey, should I just ignore this altogether and not redirect?" ... and if so, it simply returns, so the page is not redirected at all.
Does that make sense? Or am I misinterpreting?
Comment #6
m.stentaAgain, just to repeat my use-case. I have an AJAX callback that needs to be able to work in both HTTP and HTTPS... without redirecting!
Currently with uc_ssl, I don't think that's possible. If I put it in the included URLs hook... it's always HTTPS. If I put it in the excluded URLs hook... it's always HTTP.
I need it to NOT redirect on that specific path. And that's what the purpose of this new hook is: to define paths that should NOT redirect.
Comment #7
crystaldawn commentedI guess I dont fully understand why you would need that, but if it's something you need I can put the patch into both versions. I prefer to give other modules more flexibility than building it into the module itself so I'm more inclined to add a hook like this than a feature. Currently I am doing 7.x this week. 6.x will be this weekend probably.
Comment #8
crystaldawn commentedI have this in git for 7.x now, but I've changed the logic around a bit because for some reason you had the if clause inside the Mixed SSL mode section and I believe that you wanted it to ignore any switching at all so it should go above both modes so as to not even make it into those checks. I then rolled it into a release so you could check to see if it does what you would like to do.
Comment #9
m.stentaYea, I figured it made sense to put it in that section, because in non-mixed SSL mode, EVERYTHING is SSL no matter what. But it's neither here nor there... putting it before all of that logic makes sense too, and should have the same effect. Cool, thanks for giving this consideration!
I'm using this on a 6.x site, so I'm looking forward to that release, but I've got my module patched already, so it's not urgent. Good to get in, though. Thanks for the work on this!
Comment #10
crystaldawn commentedWow what a coincidence. One of the sites I had to work on today actually needed this type of functionality. Their cert didnt cover subdomains and rather than break the site, they wanted to simply ignore any ssl switching for any URL that had a subdomain in it until they had time to buy a wildcard SSL cert. This hook was able to fix that issue quite easily. Thanx for the idea btw. I cant believe I actually made use of it lol. I thought I'd never make use of this hook :P Their custom module makes use of this hook temporarily until they can get a wildcard cert. Slick stuff.
BTW, I dont know whats up with the cron service but there seem to be 2 releases stuck in the queue that havent been packaged yet. If you look at the releases queue you'll see the 2 red releases. Hopefully that sorts itself out on its own. It usually doesnt take this long to pack a release.
Comment #11
m.stentaAwesome! That's great that you were able to make use of it too!
I suppose it makes sense to add some description to the project page and other documentation for this new hook. Maybe once it's in an official non-dev release... up to you.
Yea, I've noticed that sometimes dev releases take a LONG time to appear. Normal releases usually appear quicker, so maybe dev releases are lower priority (makes sense).
Comment #12
crystaldawn commentedYa thats the weird part. I put it into an official release. I have had way to many problems with the whole long delay issue with dev releases so I dont even bother to use it anymore. It appears like the cron is set longer, but SIGNIFICANTLY longer. I've had some dev releases take weeks to package. So I just quit using it all together.
Comment #13
crystaldawn commented