Le 24/11/2016 à 18:05, Matthieu Imbert a écrit :
Hi,I'm willing to force https for our fusionforge instance, (because with the default configuration of fusionforge, http is enabled and various login passwords can travel "in clear" on the network, which I found rather unsecure)For this purpose, I uncomment the two last lines in /etc/fusionforge/httpd.conf.d/ssl-off.inc:RewriteEngine On RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]After that everything works fine, except that some mailing lists administrators are not able anymore to moderate their lists: in the admin page of their list, when they choose to accept / reject some mails and then click the "submit" button, an http link is hit (I know that because they get a warning that the data will be submitted over an unencrypted channel), which is then rewritten by apache to https, and this does not work, the moderation choices are ignored.I think this is related to the configuration in /etc/mailman/mm_cgf.py: DEFAULT_URL_PATTERN = 'http://%s/mailman/'So I'm considering patching (and submitting for inclusion) src/post-install.d/lists/lists.sh so that DEFAULT_URL_PATTERN in mm_cfg.py begins either with http or https, depending on the forge config variable use_sslAs I fear to lack a clear overview of the way all of this is supposed to work, I would like if someone with a better knowledge of fusionforge could confirm if this is the right way to do or not?kind regards,
Hi, your proposition is correct. Please submit for inclusion. Regards, Franck -- TrivialDev Founder http://trivialdev.com
<<attachment: franck_villaume.vcf>>
_______________________________________________ Fusionforge-general mailing list Fusionforge-general@lists.fusionforge.org http://lists.fusionforge.org/cgi-bin/mailman/listinfo/fusionforge-general
