From 24c090a08d365a6edf263166e818c53e5f10982b Mon Sep 17 00:00:00 2001 From: Guangcong Luo Date: Tue, 21 Nov 2017 06:30:05 -0500 Subject: [PATCH] Default to HTTPS Chrome peer-pressuring us by locking Notification behind HTTPS... they also lock plenty of other things behind HTTPS and the trade-off seems worth-it now. --- .htaccess | 22 +++++++++++++--------- js/client-teambuilder.js | 3 +++ js/client.js | 16 +++++++++------- package.json | 2 +- recoverteams.html | 35 +++++++++++++++++++++++++++++++++++ showdown.webapp | 2 +- 6 files changed, 62 insertions(+), 18 deletions(-) create mode 100644 recoverteams.html diff --git a/.htaccess b/.htaccess index 7e0b01d5b..2a22900d7 100644 --- a/.htaccess +++ b/.htaccess @@ -16,8 +16,10 @@ AddType application/x-web-app-manifest+json .webapp RewriteEngine on -RewriteCond %{HTTP:X-Forwarded-Proto} ^https$ -RewriteRule ^(.*) - [E=P_SUFFIX:s] +RewriteCond %{HTTP:X-Forwarded-Proto} ^http$ +RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] +RewriteCond %{QUERY_STRING} !^insecure [NC] +RewriteRule ^([A-Za-z0-9-]*)$ https://play.pokemonshowdown.com/$1 [R=307,NE,L] # basic stuff RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] @@ -44,20 +46,22 @@ RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] RewriteRule ^contact\/?$ http://pokemonshowdown.com/contact [R=302,L] RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] RewriteRule ^dex\/?$ http://dex.pokemonshowdown.com/ [R=302,L] +RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] +RewriteRule ^insecure\/?$ http://play.pokemonshowdown.com/?insecure [R=302,L] RewriteCond %{HTTP_HOST} ^www\.play\.pokemonshowdown\.com$ [NC] -RewriteRule ^(.*) http%{ENV:P_SUFFIX}://play.pokemonshowdown.com/$1 [R=301,L] +RewriteRule ^(.*) https://play.pokemonshowdown.com/$1 [R=301,L] RewriteRule ^style/fonts?/.*?\.(eot|svg|ttf|woff|woff2)$ - [E=SAFE_RESOURCE:1] Header set Access-Control-Allow-Origin * env=SAFE_RESOURCE # Redirect old battles to their corresponding replay # RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] -# RewriteRule ^battle-([a-z0-9]+-[12][0-9]{8})$ http%{ENV:P_SUFFIX}://replay.pokemonshowdown.com/$1 [R=302,L] +# RewriteRule ^battle-([a-z0-9]+-[12][0-9]{8})$ https://replay.pokemonshowdown.com/$1 [R=302,L] RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] -RewriteRule ^battle-([a-z0-9]+-[0-9]{8})$ http%{ENV:P_SUFFIX}://replay.pokemonshowdown.com/$1 [R=302,L] +RewriteRule ^battle-([a-z0-9]+-[0-9]{8})$ https://replay.pokemonshowdown.com/$1 [R=302,L] RewriteCond %{HTTP_HOST} ^play\.pokemonshowdown\.com$ [NC] -RewriteRule ^battle-([a-z0-9]+)$ http%{ENV:P_SUFFIX}://replay.pokemonshowdown.com/$1 [R=302,L] +RewriteRule ^battle-([a-z0-9]+)$ https://replay.pokemonshowdown.com/$1 [R=302,L] # TODO: fix bug where you can't join lobby directly RewriteRule ^lobby/?$ / [R=301,L] @@ -89,13 +93,13 @@ RewriteCond %{REMOTE_ADDR} !=162.243.13.96 RewriteCond %{HTTP:CF-Connecting-IP} !=173.252.196.254 RewriteCond %{HTTP:CF-Connecting-IP} !=198.27.67.31 RewriteCond %{HTTP:CF-Connecting-IP} !=162.243.13.96 -RewriteRule .* http%{ENV:P_SUFFIX}://pokemonshowdown.com/ [R=303,L] +RewriteRule ^.* https://pokemonshowdown.com/ [R=303,L] -RewriteRule ^replay/battle-([A-Za-z0-9-]+)$ http%{ENV:P_SUFFIX}://pokemonshowdown.com/replay/$1 [R=302,L] +RewriteRule ^replay/battle-([A-Za-z0-9-]+)$ https://replay.pokemonshowdown.com/$1 [R=302,L] RewriteRule ^replay/turn_(.+)\.png$ replay/turn-image.php?data=$1 [L,QSA] RewriteCond %{QUERY_STRING} !output=html -RewriteRule ^ladder\.php$ http%{ENV:P_SUFFIX}://pokemonshowdown.com/ladder/ [R=301,L] +RewriteRule ^ladder\.php$ https://pokemonshowdown.com/ladder/ [R=301,L] RewriteRule ^~~([^:/]*)(:[0-9]*)?/action\.php$ action.php?serverid=$1 [L,QSA] RewriteRule ^~~([^:/]*)(/.*)?$ http://$1.psim.us$2 [R=301,L] diff --git a/js/client-teambuilder.js b/js/client-teambuilder.js index 7a07b335b..87ad47fdd 100644 --- a/js/client-teambuilder.js +++ b/js/client-teambuilder.js @@ -321,6 +321,9 @@ buf += '

Hi

'; buf += '

Did you have a good day?

'; buf += '

'; + if (Storage.teams && !Storage.teams.length) { + buf += '

Some people have reported losing their teams in our switch to HTTPS. If that\'s you, use this Team Recovery Tool to get your teams back.

'; + } buf += '

All teams

'; } else { if (this.curFolder.slice(-1) === '/') { diff --git a/js/client.js b/js/client.js index 502797af6..f265878b8 100644 --- a/js/client.js +++ b/js/client.js @@ -726,12 +726,6 @@ this.socket.onclose = function () { if (!socketopened) { if (Config.server.altport && !altport) { - if (document.location.protocol === 'https:') { - if (confirm("Could not connect with HTTPS. Try HTTP?")) { - return document.location.replace('http://' + - document.location.host + document.location.pathname); - } - } altport = true; Config.server.port = Config.server.altport; self.socket = reconstructSocket(self.socket); @@ -2513,7 +2507,11 @@ if (data.cantconnect) { buf += '

Couldn\'t connect to server!

'; - buf += '

'; + if (document.location.protocol === 'https:') { + buf += '

'; + } else { + buf += '

'; + } } else if (data.message && data.message !== true) { buf += '

' + data.message + '

'; buf += '

'; @@ -2525,6 +2523,10 @@ buf += ''; this.$el.html(buf); }, + tryhttp: function () { + document.location.replace('http://' + + document.location.host + document.location.pathname + '?insecure'); + }, submit: function (data) { document.location.reload(); } diff --git a/package.json b/package.json index 54a0a5456..f196581d8 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "pokemon-showdown-client", "version": "0.11.0", "author": "Guangcong Luo (http://guangcongluo.com)", - "homepage": "http://play.pokemonshowdown.com", + "homepage": "https://pokemonshowdown.com", "license": "AGPL-3.0", "repository": { "type": "git", diff --git a/recoverteams.html b/recoverteams.html new file mode 100644 index 000000000..cc4dcd356 --- /dev/null +++ b/recoverteams.html @@ -0,0 +1,35 @@ + + + + + + + + + + + +Instructions: +
    +
  1. Copy the text in the big text box below +
  2. Go to https://play.pokemonshowdown.com/teambuilder
    3. +
  3. Click "Backup/Restore all teams" near the bottom
    4. +
  4. Paste the text you copied to the bottom
    5. +
  5. Click "Save"
    6. +
+ + diff --git a/showdown.webapp b/showdown.webapp index 282709a9f..94e7b0a7b 100644 --- a/showdown.webapp +++ b/showdown.webapp @@ -11,7 +11,7 @@ }, "developer": { "name": "Guangcong Luo", - "url": "http://pokemonshowdown.com/" + "url": "https://pokemonshowdown.com/" }, "installs_allowed_from": [ "https://appstore.mozillalabs.com",