Essential theme with gradebook over https

Essential theme with gradebook over https

by Trevar Pearce -
Number of replies: 5
Hi there,

We have enabled https for gradebook pages on our Moodle site and find that in courses that use the Essential theme, much of the style is not being loaded. I looked at the source for an affected gradebook page and saw that the stylesheet link looks like this (note: I have replaced our actual domain with 'ourdomain.ourdomain below, but it is correct in original source view):

<link rel="stylesheet" href="//ourdomain.ourdomain.ca/pluginfile.php/1/theme_essential/style/-1/essential.css">

What's missing here is the 'https:' and as a result, the css file is being requested over http.

Digging into the Essential theme code, I found that the URL for this link is built with a function called get_csswww(), which is in the \[moodleroot]\theme\essential\renderers\core_renderer.php file. The get_csswww() function is:

public function get_csswww() {
        global $CFG;

        if (!$this->theme_essential_lte_ie9()) {
            if (right_to_left()) {
                $moodlecss = 'essential-rtl.css';
            } else {
                $moodlecss = 'essential.css';
            }

            $syscontext = context_system::instance();
            $itemid = theme_get_revision();
            $url = moodle_url::make_file_url("$CFG->wwwroot/pluginfile.php", "/$syscontext->id/theme_essential/style/$itemid/$moodlecss");
            $url = preg_replace('|^https?://|i', '//', $url->out(false));
            return '<link rel="stylesheet" href="'.$url.'">';
        } else {
            if (right_to_left()) {
                $moodlecssone = 'essential-rtl_ie9-blessed1.css';
                $moodlecsstwo = 'essential-rtl_ie9.css';
            } else {
                $moodlecssone = 'essential_ie9-blessed1.css';
                $moodlecsstwo = 'essential_ie9.css';
            }

            $syscontext = context_system::instance();
            $itemid = theme_get_revision();
            $urlone = moodle_url::make_file_url("$CFG->wwwroot/pluginfile.php", "/$syscontext->id/theme_essential/style/$itemid/$moodlecssone");
            $urlone = preg_replace('|^https?://|i', '//', $urlone->out(false));
            $urltwo = moodle_url::make_file_url("$CFG->wwwroot/pluginfile.php", "/$syscontext->id/theme_essential/style/$itemid/$moodlecsstwo");
            $urltwo = preg_replace('|^https?://|i', '//', $urltwo->out(false));
            return '<link rel="stylesheet" href="'.$urlone.'"><link rel="stylesheet" href="'.$urltwo.'">';
        }
    }

From what I can tell, this code is looking for 'https:' in the URL and stripping it out before returning it to the file that builds the page. I have tried commenting out the lines that strip out the 'https:' but caused other problems by doing so.

We are running Moodle 2.7.11 and Essential 2.7.9.5.2 (Build: 2014111010). Any assistance with this would be greatly appreciated.

Thanks,

Trevar
Average of ratings: -
In reply to Trevar Pearce

Re: Essential theme with gradebook over https

by Gareth J Barnard -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers

Hi Trevar,

The code is consistent with the core version: https://github.com/moodle/moodle/blob/MOODLE_27_STABLE/lib/outputlib.php#L1435-L1455 - whereby the protocol is stripped off.  Thus my understanding is that the browser then decides to request either by https or http.  And thus if Essential's code does not work then neither does anything else that employs that core method.

What does the browsers console show?

How do you know its being requested over http instead of https?

You could comment out the preg_replace and change $CFG->wwwroot to $CFG->httpswwwroot

G

Average of ratings: Useful (1)
In reply to Gareth J Barnard

Re: Essential theme with gradebook over https

by Gareth J Barnard -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers

Also see: https://github.com/gjb2048/moodle-theme_essential/issues/321

Is your $CFG->wwwroot set to use https?

In reply to Gareth J Barnard

Re: Essential theme with gradebook over https

by Trevar Pearce -

Hi Gareth,

Thank you for both of your replies. We have code in [moodleroot]\config.php that changes $CFG->wwwroot from http to https if the requested page is a gradebook page. Down the road we will likely go all-https, but external images, etc are much less of an issue on gradebook pages than in the rest of the site. But to answer your question, $CFG->httproot is set to use https if a user is on the gradebook page.

It turns out that different browsers behave differently with respect to the href="\\..." link. Firefox and Chrome (on Windows) both treat it as http and block the content. IE 11 does not block it, though there is something else on the page that it does block. The Firefox console does confirm that it is blocking the css file.

Given what you've pointed out in the core code, it seems that the particular solution that we've implemented may indeed not work well on other parts of the site. I have looked more into the Essential code and the preg_replace is used in quite a few files. I'll continue to plug away and see if I can get it working.

Thanks again for your assistance thus far.

Trevar

In reply to Trevar Pearce

Re: Essential theme with gradebook over https

by Gareth J Barnard -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers

Hi Trevar,

Intriguing.  I need to think some more.  The issue I have is that I don't have access to a https site to test on.  I do run a local bespoke Apache MySQL PHP setup but have never tried configuring mod_security.

I think its not the case of preg_replace but working out what the solution really should be for both http and https sites.

Perhaps the dynamic changing of $CFG->wwwroot is an issue as some things are cached.  I did read on one site about https (in relation to //) no longer being the overhead that it was.  Therefore going full https and using $CFG->httpswwwroot might be something to try.  If so, then I'll see if its fine for http sites too.

I must point out that I'm no longer making any releases below M2.9 due to the amount of time it takes to maintain the theme.

Kind regards,

Gareth