Theme previews don't work in SSL

[SergeyBiryukov]

1. Go to ​https://wordpress.org/themes/expound.
2. Click "Preview".
3. Loading animation appears, but the preview frame never loads.

Firebug displays an error in JS console:

Blocked loading mixed active content "http://wp-themes.com/expound?"
https://s.w.org/wp-includes/js/jquery/jquery.js?v=1.10.2
Line 4

[Otto42]

Known issue. It's because we don't have a proper ssl certificate for wp-themes.com yet.

[nacin]

In both Chrome and Firefox, what should be loaded in an iframe is instead loaded as a normal pageview. Is this not what you see?

[Otto42]

@nacin That is by accident rather than design. The thickbox and theme-preview.js code have not been changed to be loaded over https yet. If you happen to have them load, the previewer iframe shows normally.

[johnbillion]

Core ticket: ​#WP21919

[Otto42]

#483 was marked as a duplicate.

[Otto42]

Update: The SSL certificate on wp-themes.com is now correct, so we need to modify the various links to be https capable there.

[johnbillion]

Thanks Otto. Looks like we might still get mixed content warnings here though due to the embedded images on the site.

[SergeyBiryukov]

Related: ​#WP28733

[jeffr0]

I'm using Firefox 32.0.2 and I see only the loading bar when clicking on a theme demo image. It works fine in Chrome.

[Otto42]

Seems to be working for me on Firefox 32.0.2, Windows 8. I updated the image path of the loading bar, but I doubt that had any effect.

This particular ticket was fixed a while back, actually, when we got the SSL certificate. I updated the various paths there to point to https. Should be working all around, though there may still be a mixed content issue or two somewhere here. If you spot one, let me know.

[Otto42]

Actually, updating the loading bar path probably did have an effect. The old URL was redirecting to a non-https URL. This could have caused a mixed content issue that might have blocked it.

Try a different theme page and or clearing browser cache/hard reload.

[SergeyBiryukov]

I've cleared the cache, but can still reproduce the issue in Firefox 32.0.2, exactly as described in the ticket.

In Chrome 37, what should be loaded in an iframe is loaded as a normal pageview, but I see errors in the console:

[blocked] The page at 'https://wordpress.org/themes/expound' was loaded over HTTPS, but ran insecure content from 'http://wordpress.org/bb-theme/themes/thickbox/thickbox.css': this content should also be loaded over HTTPS.
[blocked] The page at 'https://wordpress.org/themes/expound' was loaded over HTTPS, but ran insecure content from 'http://wordpress.org/bb-theme/themes/thickbox/thickbox.js': this content should also be loaded over HTTPS.
[blocked] The page at 'https://wordpress.org/themes/expound' was loaded over HTTPS, but ran insecure content from 'http://wordpress.org/bb-theme/themes/thickbox/theme-preview.js': this content should also be loaded over HTTPS.

Perhaps the fix is not fully propagated yet?

[Otto42]

Yeah, I don't know what is going on.

​https://wordpress.org/bb-theme/themes/thickbox/thickbox.js is the file with the change. The top two lines of the file should start with /bb-theme and not /extend, but Firefox seems to be pulling the old one somehow and not the new one.

Chrome shows me the new one. The old one does not exist anymore anywhere I know of.

[Otto42]

Okay, I forced the URL to cachebust and fixed the preview URL and it works now. No idea what is causing the extreme caching on that JS, but busting it works.

[SergeyBiryukov]

Works for me now as well in both Firefox and Chrome.

[deltafactory]

Seeing this today in Firefox 33.1 and Chrome 39 on Windows 7.

Specifically seeing it from the tag-filter search results which also seem to have a redirect loop in Chrome.

[Otto42]

Seems to be working okay for me in Firefox 33.1.1 and latest Chrome on Windows 8. Can't think of why it would be special in Windows 7.

[Otto42]

Nevermind. Missed the tag-filter bit. Fixed.