On 4/11/14, 5:54 PM, Dan Stillman wrote: > On 4/11/14, 11:59 AM, Rintze Zelle wrote: >> Agreed. The main requirement is that the style "self"-link should >> resolve to an online copy of the style, and that won't be a problem if >> we stick to using "http". > > Just to make sure this is what you're saying, the rel="self" links for > Zotero-hosted styles can and should be "https". It's just the ids that > should stay as "http". > > Zotero actually makes a single request that includes the ids when it > updates styles from the Zotero repo, but a client that updates each > style directly shouldn't need to trigger unnecessary redirects (and, > in theory, expose itself to some sort of XML-parsing exploit or other > mischief). > > rel="independent-parent" should also be "https", since that's used for > retrieval rather than identification. > > (There's no particular need to mass-change old styles, though.)
And I think rel="template" should also be dereferenceable (and therefore "https"), with the same logic as rel="independent-parent" — that is, in any case where you don't have the original style, you need to use the value as a locator. Once you've installed a style, directly or indirectly (via independent-parent), you have the id, which you can use as a unique identifier. ------------------------------------------------------------------------------ Put Bad Developers to Shame Dominate Development with Jenkins Continuous Integration Continuously Automate Build, Test & Deployment Start a new project now. Try Jenkins in the cloud. http://p.sf.net/sfu/13600_Cloudbees _______________________________________________ xbiblio-devel mailing list xbiblio-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/xbiblio-devel
