Comments (7)
I did some testing, phantomjs has no problem rendering images from foreign hostnames, both http & https, the only exception from our packages, it that Instagram's cdn seem to regect https requests from our phantomjs, if that's the only domain we have an issue with, I suggest addressing it in the Instagram package by using http instead of https for image references.
from c1-cms-foundation.
The Instagram package might have been affected by the recent change in the Instagram API. Please see this issue: Orckestra/CMS-Packages#10
from c1-cms-foundation.
Not only Instargam package, also LinkedIn package has the same problems. For example try next example:
<img src="https://static.licdn.com/scds/common/u/img/webpromo/btn_myprofile_160x33.png" width="160" height="33" border="0" alt="View profile on LinkedIn" />
from c1-cms-foundation.
should be easy enough to fix by creating a simple local proxy handler and rewrite all img-sources to use that proxy when rendering through phantomjs
from c1-cms-foundation.
should be easy enough to fix by creating a simple local proxy handler
Wouldn't that mean extra requests, caching, cache invalidation issues and require extra work for external resources referenced via css for instance?
One line solid fix?
PhantomJs config variable webSecurityEnabled is the culprit here - it defaults to true and will block external URLs (in latest PhantomJs which we just updated to https will always be allowed). Setting it to false (and restarting c1) should close this issue.
Setting webSecurityEnabled to false (in ~/App_Data/Composite/PhantomJs/config.json) is not very well documented, except for this bit https://github.com/adobe/webkit/blob/044126629b2e175119722f58a0098220e0aa0b33/Source/WebCore/dom/Document.cpp#L4557 - as far as I can see it will enable loading external resources (regardless of protocol) and will also enable cross domain XHR. I cannot phantom any situation where this will be an issue, especially given the fact that what we are rendering is completely under dev control. If anyone can see us creating a new attack surface here, please share.
from c1-cms-foundation.
Wouldn't that mean extra requests, caching, cache invalidation issues and require extra work for external resources referenced via css for instance?
An extra request, yes, but for a local address which acts as a simple pass-through proxy so it wouldn't take any extra resources if done using an IHttpAsyncHandler
Instead of
you would do
- PhantomJs > {LocalUri}/Renderers/FunctionPreviewProxy.ashx?url=https://static.licdn.com/scds/common/u/img/webpromo/btn_myprofile_160x33.png > https://static.licdn.com/scds/common/u/img/webpromo/btn_myprofile_160x33.png
It was a simple suggestion on an issue that was several months old, and while it wouldn't fix all scenarios, like external images references in css documents, it would be better than nothing.
But surely, if there is a switch in PhantomJs which enables https requests, then that should simple be enabled.
from c1-cms-foundation.
Not only Instargam package, also LinkedIn package has the same problems...
Couldn't reproduce this issue (Tried on as early as 20151216.1)
Verified on 20160420.1
from c1-cms-foundation.
Related Issues (20)
- Possibility of grouping FunctionParameters i Razor functions
- Composite NuGet package CompositeC1.Core vs C1CMS.Assemblies HOT 5
- Bug when deleting parent record, CascadeDelete is set to false and was supposed to clear the reference to null
- Linking to Media Items in C1 CMS v6.11 HOT 3
- Items can't be duplicated with 8-char random string ID based data types
- Upgrading to C1 6.12 HOT 7
- ImageResizer not working if not logged in (after upgrade to 6.12) HOT 1
- "Please Upgrade - To Stay Safe" - Question about notification HOT 1
- DataTypeDescriptor Clone does not clone "Cachable"
- CompositeC1.Core 6.12 in NuGet HOT 1
- Extend IMediaFile
- Index PDF files on Azure HOT 4
- Upgrading to C1 6.13 HOT 1
- Cannot use Composite.Core.Routing.Pages.C1PageRoute.RegisterPathInfoUsage() on secondary hostnames' home page
- Allow for various extensionpoint-classes to be DI-friendly
- Expired SSL Certificate on https://c1console.composite.net/C1.aspx HOT 4
- Donut caching breaks functions using C1PageRoute.RegisterPathInfoUsage();
- Weird behavior: Prevent RazorTemplate from executing functions when binding placeholders HOT 2
- Scale images in mediabrowser and mediapicker
- Show WebP files in the Image selector dialog
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from c1-cms-foundation.