adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Use https on piwigo.org #444

New Issue
Closed
opened 2026-10-04 23:58:54 +02:00 by adam · 6 comments
adam commented 2026-10-04 23:58:54 +02:00
Owner
Copy link
Copy source

Please force https on all Piwigo domains.

http is insecure and can be compromised: Links to download site could be manipulated, user data can be manipulated or stolen, logins can be hijacked...

You may be interested in CSP upgrade-insecure-requests for a quick and smooth migration.

Please force https on all Piwigo domains. http is insecure and can be compromised: Links to download site could be manipulated, user data can be manipulated or stolen, logins can be hijacked... You may be interested in CSP upgrade-insecure-requests for a quick and smooth migration. <!-- github-sync-id:148743091 -->
adam closed this issue 2026-10-04 23:58:54 +02:00
adam commented 2026-10-04 23:58:55 +02:00
Author
Owner
Copy link
Copy source

I disagree with this. Sure there should be an OPTION to force https on piwigo in the admin control panel however blatantly just forcing https when not everyone has an ssl cert can cause issues. @J0WI

I agree that http can be insecure however you should also realise that until https://letsencrypt.org/ came into existance ssl certs were expensive as hell and letsencrypt is still technically in beta.

So forcing https on everyone when some hosts can't afford ssl certs or don't have ssl certs is a VERY BAD IDEA.

I fully support adding an OPTIONAL CHOICE for forcing https on clients in THE ADMIN CONTROL PANEL and even this should have a check to see if the server actually has an ssl certificate so that its not activated if the server doesn't have one. (to prevent issues with people who use the option and dont know about ssl.)
@plegall

I disagree with this. Sure there should be an OPTION to force https on piwigo in the admin control panel however blatantly just forcing https when not everyone has an ssl cert can cause issues. @J0WI I agree that http can be insecure however you should also realise that until https://letsencrypt.org/ came into existance ssl certs were expensive as hell and letsencrypt is still technically in beta. So forcing https on everyone when some hosts can't afford ssl certs or don't have ssl certs is a VERY BAD IDEA. I fully support adding an OPTIONAL CHOICE for forcing https on clients in THE ADMIN CONTROL PANEL and even this should have a check to see if the server actually has an ssl certificate so that its not activated if the server doesn't have one. (to prevent issues with people who use the option and dont know about ssl.) @plegall <!-- github-comment-id:210721330 -->
adam commented 2026-10-04 23:58:56 +02:00
Author
Owner
Copy link
Copy source

@kamijoutouma I'm not sure if you understood me correctly. I'm refering to domains/hosts that are owned by Piwigo itself (eg. *.piwigo.org, *.piwigo.com, piwigo.es etc.).

@kamijoutouma I'm not sure if you understood me correctly. I'm refering to domains/hosts that are owned by Piwigo itself (eg. *.piwigo.org, *.piwigo.com, piwigo.es etc.). <!-- github-comment-id:210799962 -->
adam commented 2026-10-04 23:58:57 +02:00
Author
Owner
Copy link
Copy source

@J0WI when you said "all Piwigo domains" i had assumed you meant "all domains that use piwigo's source code". But since that's not the case you should really place this on the forums instead of on github as this issue page is for the Piwigo image hosting source code and not the piwigo domain. @plegall

@J0WI when you said "all Piwigo domains" i had assumed you meant "all domains that use piwigo's source code". But since that's not the case you should really place this on the forums instead of on github as this issue page is for the Piwigo image hosting source code and not the piwigo domain. @plegall <!-- github-comment-id:210966864 -->
adam commented 2026-10-04 23:58:57 +02:00
Author
Owner
Copy link
Copy source

If the issue is about switching piwigo.org to HTTPS, then I reply that we're not at the right place to discuss about that :-) http://piwigo.org/forum/viewforum.php?id=28 is the right place.

If the issue is about switching piwigo.org to HTTPS, then I reply that we're not at the right place to discuss about that :-) http://piwigo.org/forum/viewforum.php?id=28 is the right place. <!-- github-comment-id:213693723 -->
adam commented 2026-10-04 23:58:58 +02:00
Author
Owner
Copy link
Copy source

@plegall the cause why I posted it here is because I refuse to create an account only for this post.
And I also feel uncomfortable to do this on a site, that provide no secure login or contact form. ;)
Furthermore this also affect the security of Piwigo itself because of the scenario explained above with downloading from an insecure page.

So I hope you will address this issue of this anyway.

@plegall the cause why I posted it here is because I refuse to create an account only for this post. And I also feel uncomfortable to do this on a site, that provide no secure login or contact form. ;) Furthermore this also affect the security of Piwigo itself because of the scenario explained above with downloading from an insecure page. So I hope you will address this issue of this anyway. <!-- github-comment-id:213704178 -->
adam commented 2026-10-04 23:58:59 +02:00
Author
Owner
Copy link
Copy source

Well OK you're coherent ;-)

We have not planned to "fix" that "soon" but we will do it. Switching to HTTPS is not as easy as adding an SSL cert.

Well OK you're coherent ;-) We have not planned to "fix" that "soon" but we will do it. Switching to HTTPS is not as easy as adding an SSL cert. <!-- github-comment-id:213704759 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#444