Use the correct protocol for S3 attachment URLs based on the request security level

[hprange]

Problem: the generated URL for S3 attachments always uses the HTTP protocol. In the context of secure requests (made over HTTPS), the generated URL should use the HTTPS protocol instead.

Solution: Chosing the URL protocol during persistence of the attachment is not ideal because the attachment may be used in secured and unsecured contexts later. The correct protocol should be determined during the URL generation. This patch replaces the HTTP protocol and removes the port (:80) from the generated URL whenever the request is secure.

[darkv]

Hi Henrique,

instead of fixing the String wouldn't it make sense to get the correct URL in the first place? What about replacing the line 142 with:

attachmentUrl = context.completeURLWithRequestHandlerKey(ERAttachmentRequestHandler.REQUEST_HANDLER_KEY, attachmentUrl, null, request.isSecure(), 0);

That should respect the secure setting. Does that work?

[hprange]

Hi Johann,

Thanks for your feedback.

The original code with the urlWithRequestHandlerKey method already decides if the request is secure or not internally. I haven't verified it, but I believe the behavior is correct when the attachment is proxied. When the attachment is not proxied, however, the URL is returned from the s3Path property without any special treatment. Something like this http://s3.amazonaws.com:80/....

Now I see I wasn't clear about the fact that this patch fixes the problem when the attachment is not proxied. In this case, replacing the s3Path contents looks like a simple solution to the problem.

What do you think?

[darkv]

If I got it right you need to fix the URL if the delivery is done directly by S3 instead of WO proxying the request. In that case if you access WO via HTTPS the URL for S3 should be HTTPS too but isn't because of the HTTP constant in S3_URL, correct?

So it would be better to put the if clause in line 155 in an else as this would correspond to !attachment.proxied() (see line 134).

[hprange]

Done.