Previous Thread
Next Thread
Print Thread
Hop To
Transition Your Forum From HTTP to HTTPS #260501 09/23/2017 3:14 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
Make the transition of an existing UBB.threads forum from http to https.

Summary
1) Obtain a valid security certificate from your webhost or a reputable third-party seller. I've purchased many "PositiveSSL" certs from SSLs.com.
2) Install it using SHA-2 and make sure it is configured properly.
3) Update ALL your URLs in the Control Panel or manually in your config.ini file. This includes the Homepage URLs, Contact pages, Referer Check, any forum headers/footers, etc.
4) Run a SQL query on your posts, private messages, user avatars, profile comments tables to replace "http://www.YOURDOMAIN.COM" with "https://www.YOURDOMAIN.COM"
5) Set up HTTP to HTTPS 301 redirects in your .htaccess file to forward from http:// to https://
6) Update all external plugins to ensure they are HTTPS compliant (sharaholic, twitter, facebook, youtube, ubb custom-tags, and, if your website contains non-UBB.threads content, all those internal site links - trust me you won't find them all in a single pass)
7) Test your website.
BONUS: Update your URLs in google/bing webmaster tools. Update any ads placed on your website, such as Google Adsense. Update any website analytics code.


** MAKE A BACKUP BEFORE YOU BEGIN **


The SQL
** BE VERY CAREFUL OF "POST_DEFAULT_BODY" and "POST_BODY" USAGE - DO NOT INTERCHANGE THEM
• POST_DEFAULT_BODY - [BBcode] This is the original post. CONTENT REBUILDER > REBUILD POSTS takes this and converts it to POST_BODY [HTML]
• POST_BODY - [HTML] This is shown to the user. it is generated from POST_DEFAULT_BODY

To update your POSTS:
* ubbt_POSTS - POST_DEFAULT_BODY
Code
UPDATE ubbt_POSTS
SET POST_DEFAULT_BODY = replace(POST_DEFAULT_BODY, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');

* ubbt_POSTS - POST_BODY
Code
UPDATE ubbt_POSTS
SET POST_BODY = replace(POST_BODY, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');


To update your PRIVATE MESSAGES:
* ubbt_PRIVATE_MESSAGE_POSTS - POST_DEFAULT_BODY
Code
UPDATE ubbt_PRIVATE_MESSAGE_POSTS
SET POST_DEFAULT_BODY = replace(POST_DEFAULT_BODY, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');

* ubbt_PRIVATE_MESSAGE_POSTS - POST_BODY
Code
UPDATE ubbt_PRIVATE_MESSAGE_POSTS
SET POST_BODY = replace(POST_BODY, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');


To update your USER AVATARS:
* ubbt_USER_PROFILE - USER_AVATAR
Code
UPDATE ubbt_USER_PROFILE
SET USER_AVATAR = replace(USER_AVATAR, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');


To update your PROFILE COMMENTS:
* ubbt_PROFILE_COMMENTS - COMMENT_BODY
Code
UPDATE ubbt_PROFILE_COMMENTS
SET COMMENT_BODY = replace(COMMENT_BODY, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');


To update your USER SIGNATURES:
* ubbt_USER_PROFILE - USER_DEFAULT_SIGNATURE
Code
UPDATE ubbt_USER_PROFILE
SET USER_DEFAULT_SIGNATURE = replace(USER_DEFAULT_SIGNATURE, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');

* ubbt_USER_PROFILE - USER_SIGNATURE
Code
UPDATE ubbt_USER_PROFILE
SET USER_SIGNATURE = replace(USER_SIGNATURE, 'http://www.YOURDOMAIN.COM', 'https://www.YOURDOMAIN.COM');



HTTP to HTTPS 301 Redirects For Your .htaccess File
Code
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]




Notes and Further Reading
Full URLs (http:// and https://) vs relative URLs (//):
If you want to correctly FULLY go SSL, use the full protocol name of "http://www.YOURDOMAIN.COM" instead of just "//www.YOURDOMAIN.COM"
The reason to use just double slashes instead of the HTTPS protocol declaration, is if you intend to have your secure urls (https) distribute different content than your open urls (http), since both are seen as separate urls on search engines.

If you are switching to HTTPS, it is advised to fully replace all your http protocol references with https, and forward all calls from http to https. Do not allow the browser/end-user to choose http by leaving your protocol blank with an open "//" url.

If the asset you need is available on SSL, then always use the https:// asset:
http://stackoverflow.com/questions/4831741/can-i-change-all-my-http-links-to-just/27999789#27999789

Why omitting the protocol scheme might not be a good idea:
http://stackoverflow.com/questions/4831741/can-i-change-all-my-http-links-to-just/37654145#37654145

Sometimes IE7 and IE8 do not correctly handle "//" assets. They look at this as being a file transfer, and will attempt to download the page through a download window. Even though the "//" asset is a spec from 1996/1998
https://www.paulirish.com/2010/the-protocol-relative-url/

Google deprecates protocol relative URLs in place of full protocol URLs for the html5 spec:
https://github.com/h5bp/html5-boilerplate/pull/1694/commits/045a1676c4c8cf4bdd23374b5b049507101f5043

Additional discussions:
http://stackoverflow.com/questions/...h-in-a-script-src-http/37609402#37609402


Google SEO HTTPS Migration Checklist (for the ad and SEO focused)
Source: Search Engine Roundtable
• Update all your ad code to support HTTPS
• Ensure your analytics will work on the new HTTPS URLs
• Update your site search (if not using the inbuilt UBB.threads search methods) to support HTTPS and discover new URLs sooner
• Create and submit your new HTTPS XML sitemaps
• Review the Google site move article
• Verify the new HTTPS site with Google Webmaster Tools and track indexation, crawling, search queries, etc.


Final Steps
• Test your site using the Qualys Lab tool
• Followup by searching for, and reading additional articles on "http to https site moves," to know what to expect

and...

[Linked Image]

Attached Files HTTPS SEO Checklist.jpg

isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Express Hosting
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260502 09/23/2017 3:18 PM
Joined: Jun 2006
Posts: 15,834
Gizmo Offline
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 15,834
Be sure to backup your database before preforming any maintenance as preforming any direct maintenance to the system can leave you with a complete mess and a broken forum.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Need to Upgrade? [virtualnightclub.net]
Forums: A Gardeners Forum [agardenersforum.com] Scouters World [scoutersworld.com]
UBB.threads: UBBWiki [ubbwiki.com], UBB Styles [virtualnightclub.net], UBB.Sitemaps [virtualnightclub.net]
Longtime Supporter & Resident Post-A-Holic
VNC Web Services [virtualnightclub.net]: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260533 10/02/2017 5:20 AM
Joined: Mar 2015
Posts: 87
M4TT Offline
Journeyman
Offline
Journeyman
Joined: Mar 2015
Posts: 87
Quote
6) Update all external plugins to ensure they are HTTPS compliant (sharaholic, twitter, facebook, youtube, ubb custom-tags, and, if your website contains non-UBB.threads content, all those internal site links - trust me you won't find them all in a single pass)


In layman's terms, how is this achieved? I just noticed I can't see embedded YouTube videos using the Insert Media Tag method... My SSL Report is Grade A.


[Linked Image from aliendisc.net]
[Linked Image from aliendisc.net]
[Linked Image from aliendisc.net]
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260534 10/02/2017 4:03 PM
Joined: Jun 2006
Posts: 15,834
Gizmo Offline
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 15,834
You'll have to use any 3rd party sites SSL server to provide secure content for your users; in v7.6.0 we included new UBBCodes that support SSL, simply import them (they're in the "install/custom_codes/tags.php" file in the install files you downloaded from this site) via the tag editor in the control panel (CP -> Tools & Information -> Content Rebuilder -> Custom Tag Editor Tab).


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Need to Upgrade? [virtualnightclub.net]
Forums: A Gardeners Forum [agardenersforum.com] Scouters World [scoutersworld.com]
UBB.threads: UBBWiki [ubbwiki.com], UBB Styles [virtualnightclub.net], UBB.Sitemaps [virtualnightclub.net]
Longtime Supporter & Resident Post-A-Holic
VNC Web Services [virtualnightclub.net]: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260535 10/02/2017 5:49 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
@M4TT, this is probably what you're looking for. As gizmo pointed out, all of the new codes have also been updated to support https. As usual, after youve updated, run the post/content rebuilder. If you have any third-party software or plugins on your website (not ubb.threads software), you'll need to update those for https per their own instructions.

The following is from the "Special Instructions" section of the v7.6.0 upgrade guide at
https://www.ubbcentral.com/forums/ubbthreads.php/topics/259082/7-6-0-changelog-discussion#Post259088

---

Updated Media Tags
  • Flash Video Embed
  • MySpace Video
  • Vimeo Video
  • Yahoo Video
  • YouTube Video

There are new Media Tags which support displaying videos on mobile devices. You will need to install these manually. After your forum has been upgraded, go to "Control Panel » Content Rebuilder" and select the "Custom Tag Editor" top tab. Next, choose "Import New Tags" from the bottom tab. And finally, browse to your local install/custom_codes/ directory from the "ubbthreads-XXX.zip" archive and select the "tags.php" file.

This will add new set of Media Tags to your existing set. The new items will be prefixed by "[new]". From this screen, you can also disable any tag which you dont want displayed on your forum. You should delete any of your old tags that were upgraded within the new set.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260536 10/02/2017 9:38 PM
Joined: Mar 2015
Posts: 87
M4TT Offline
Journeyman
Offline
Journeyman
Joined: Mar 2015
Posts: 87
Okay guys, I just added an s at the end of any http fields in the Content Rebuilder > Custom Tag Editor > Custom Tag List: YouTube Video and ran a rebuild on posts and it's working now!

SSL/HTTPS YouTube Embedded Fix

User Prompt Hint From Text Editor:
Code
YouTube ID; eg: xxxxxxxxxx (or https://www.youtube.com/watch?v=xxxxxxxxxx)



Resulting Markup:
Code
<object width="425" height="350">
 <param name="movie" value="https://www.youtube.com/v/\\2"></param>
 <param name="wmode" value="transparent"></param>
 <embed src="https://www.youtube.com/v/\\2"
  type="application/x-shockwave-flash" wmode="transparent"
  width="425" height="350">
 </embed>
</object>


Thanks for informing of the Custom Tag Editor, very useful!

Thank you smile


[Linked Image from aliendisc.net]
[Linked Image from aliendisc.net]
[Linked Image from aliendisc.net]
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #260539 10/03/2017 8:21 AM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
@M4TT, thats the old YouTube tag code from version 7.5.x. It is not mobile friendly and detects just 17 of the top 32 most common different YouTube URL variations. Follow the directions to upgrade to the 7.6.x Youtube REGEX strings, which can detect more than 32 of the most common YouTube variations. In addition, it will not break your forums for mobile users.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261152 02/18/2018 12:34 AM
Joined: Aug 2012
Posts: 113
sundance Offline
member
Offline
member
Joined: Aug 2012
Posts: 113
I totally ran across this thread on accident. But BOY do I NEED it! I have a forum that's probably 20-25 years old and still running strong, and upgraded to SSL (https) last fall...and never did the database on the rest of the site (forum) because I didn't want to crash it. It's so HUGE. so I basically just did the homepage, and some other non-forum pages on the site, but I Really need to do the forum cause it's affecting SEO already having mixed content. Bless you! for writing/starting this thread, and everyone who has contributed to it. I'm a website developer (mostly wordpress) who picked up this client with this old site with this UBBThreads forum on it, and it's been a struggle for me ever since I picked it up, but he really hasn't run across anyone in the area even as knowledgeable as I am, which doesn't say much really.

I'm going to read through this, as I contemplate updating some db tables, gently, one at a time. But if anyone is super-experienced and wants to lend a hand, PLEASE don't hesitate to offer. (LOL)

Anyway, ...GOOD STUFF. :-)

Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261153 02/18/2018 6:54 AM
Joined: Jan 2004
Posts: 2,475
driv Offline
Offline
Joined: Jan 2004
Posts: 2,475
Hi Donna,
I too was nervous about the switch to https, but if you follow Isaac's guide, I'm sure you'll be ok.
It went much more smoothly than I'd anticipated.

Backup first! wink


Using version :: 7.6.2
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261154 02/18/2018 1:48 PM
Joined: Aug 2012
Posts: 113
sundance Offline
member
Offline
member
Joined: Aug 2012
Posts: 113
Did I say I was scared? I guess I revealed that huh...?

Anyway, thanks for the encouragement. It really means a lot.

Last edited by sundance; 02/18/2018 1:49 PM.
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261156 02/18/2018 1:52 PM
Joined: Aug 2012
Posts: 113
sundance Offline
member
Offline
member
Joined: Aug 2012
Posts: 113
isaac, can I use this image on how to move... by any chance?

I love it. -Donna

Last edited by sundance; 02/18/2018 1:52 PM.
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261157 02/18/2018 4:11 PM
Joined: Jun 2006
Posts: 15,834
Gizmo Offline
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 15,834
The how to move graphic is from Nimbus Hosting, we have no ownership over it.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Need to Upgrade? [virtualnightclub.net]
Forums: A Gardeners Forum [agardenersforum.com] Scouters World [scoutersworld.com]
UBB.threads: UBBWiki [ubbwiki.com], UBB Styles [virtualnightclub.net], UBB.Sitemaps [virtualnightclub.net]
Longtime Supporter & Resident Post-A-Holic
VNC Web Services [virtualnightclub.net]: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261608 08/14/2018 12:58 PM
Joined: Dec 2003
Posts: 5,898
Ruben Offline
Offline
Joined: Dec 2003
Posts: 5,898
what about urls in custom island code?


Blue Man Group
There is no such thing as stupid questions. Just stupid answers
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261609 08/14/2018 1:02 PM
Joined: Jun 2006
Posts: 15,834
Gizmo Offline
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 15,834
Everything, your essentially replacing one format for another.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Need to Upgrade? [virtualnightclub.net]
Forums: A Gardeners Forum [agardenersforum.com] Scouters World [scoutersworld.com]
UBB.threads: UBBWiki [ubbwiki.com], UBB Styles [virtualnightclub.net], UBB.Sitemaps [virtualnightclub.net]
Longtime Supporter & Resident Post-A-Holic
VNC Web Services [virtualnightclub.net]: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261610 08/14/2018 3:19 PM
Joined: Dec 2003
Posts: 5,898
Ruben Offline
Offline
Joined: Dec 2003
Posts: 5,898
Thanks.


Blue Man Group
There is no such thing as stupid questions. Just stupid answers
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #261920 12/16/2018 4:37 PM
Joined: Oct 2008
Posts: 97
PianoWorld Offline
Journeyman
Offline
Journeyman
Joined: Oct 2008
Posts: 97
I'd love to move our entire forums over to https, but we don't have any control over the thousands of images linked from off site.
Any suggestions about these (short of going through 2 million+ posts)?

Thanks,
Frank B.
Piano World
forum.pianoworld.com


Founder/Host
Piano World
https://PianoWorld.com
Home of the world famous Piano Forums.
http://forum.PianoWorld.com
88,000+ registered members
Over 2.5 million posts, and growing...
Re: Transition Your Forum From HTTP to HTTPS [Re: PianoWorld] #261922 12/16/2018 4:52 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
Originally Posted by PianoWorld
we don't have any control over the thousands of images linked from off site.

You dont have any control over hot-linked images on your site other than to continue allowing them to be hot-linked, or blocking them entirely. If you continue to allow them to be hot-linked using their http address, you could set your .htaccess file to be less-strict and allow those items of a certain file type, or from within a certain path. Or you could set your .htaccess to just forward all http page requests to https pages, still allowing all media to be accessible through their http... and https addresses.


Originally Posted by PianoWorld
Any suggestions about these (short of going through 2 million+ posts)?

As detailed within the very first post of this thread, use the SQL commands to find all occurrences of (for example) "http://pianoworld.com" and replace with "https://pianoworld.com". The process takes less than an hour to complete. Backing-up your database is where the majority of your time will be spent.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262601 04/24/2019 11:56 AM
Joined: Aug 2004
Posts: 458
Conrad Offline
Addict
Offline
Addict
Joined: Aug 2004
Posts: 458
Does the change to https need to be done manually or does upgrading to the latest version of Threads handle that automatically?

Re: Transition Your Forum From HTTP to HTTPS [Re: Conrad] #262606 04/24/2019 1:12 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
If you are doing a brand new install of UBB.threads, you would set it up with the protocol you intend to for your new forum.

Changing the protocol or domain/domain structure of your already established website needs to be manually. The easy-to-follow directions are posted in the OP of this thread. When you intend to move your forums to another protocol or domain/domain structure, the list in the OP should be used.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262736 05/30/2019 7:21 PM
Joined: Oct 2008
Posts: 97
PianoWorld Offline
Journeyman
Offline
Journeyman
Joined: Oct 2008
Posts: 97
This is a very helpful post.
Unfortunately I've not figured out what to do about the thousands of posts containing images hosted outside of our domain, and not on https.
I've noticed some browsers get really ticked off when you have mixed secure/non-secure content.


Founder/Host
Piano World
https://PianoWorld.com
Home of the world famous Piano Forums.
http://forum.PianoWorld.com
88,000+ registered members
Over 2.5 million posts, and growing...
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262737 05/30/2019 7:31 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
some of those sites are now also on https.

go through a few of those linked images to get an idea of which sites are linked to the most.

then check if those sites are using https and test a few of their images with their https.

now you have an idea of a large group of urls that you can pass a sql query to, converting them from:
http://example.com/image.jpg
to
https://example.com/image.jpg

for the rest of the sites, and other random ones, you can either keep them as they are or risk doing a batch conversion again. this is one dellema which many long running websites need to deal with.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262738 05/30/2019 8:02 PM
Joined: Oct 2008
Posts: 97
PianoWorld Offline
Journeyman
Offline
Journeyman
Joined: Oct 2008
Posts: 97
Thanks Issac,
I know we aren't big by some standards, but at over 2,800,000 posts I'm a little leery of trying to find all the instances that need to be switched over.
As you know, you only have to miss one on a page (even if it's a background dot) to have the browsers complain (or even stop the content from loading).

I've been told it can be done this way...
=====================================
(suggested by one of our forums members)

The standard way to fix mixed content issues like this is to make an ssl proxy for images when it’s detected that they come from insecure http. What this means is that the forum server scans URLs to see if they are insecure and then downloads the image itself and then serves it as https. I’m surprised that UBB.threads doesn’t support this out of the box (and I searched a little and doesn’t appear to) but it’s literally 5 or 6 lines of php to do this. And I like to think I’m not just an “armchair expert” as I write code for a pretty big internet company and do stuff like this a lot smile Actually I’m not sure if Frank would be comfortable but I’d be happy to make the change or provide his web developer with the info on making this change. However, this would increase bandwidth costs slightly so that could be a concern.
=========================================================

But I'm not sure what this would do to the server load, or how well it would work.

Don't get me wrong, I'd love to make our forums secure. I know the search engines are starting to penalize sites for not being secure. I just don't want to do more harm then good, and still end up with a mixed bag.

Best,
Frank B.
Piano World
forum.pianoworld.com
]


Founder/Host
Piano World
https://PianoWorld.com
Home of the world famous Piano Forums.
http://forum.PianoWorld.com
88,000+ registered members
Over 2.5 million posts, and growing...
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262739 05/31/2019 1:14 PM
Joined: Jun 2006
Posts: 15,834
Gizmo Offline
UBB.threads Developer
Offline
UBB.threads Developer
Joined: Jun 2006
Posts: 15,834
Development on UBB.threads was abandoned in 2009 when Rick sold UBBCentral and UBB.threads to UBBSystems, SD had been hired on to contribute security fixes and some feature additions, but until Isaac and I started development on 7.5.9+ in 2015 the product had seen little activity (there was a 2 year gap between 7.5.8 and 7.5.9).

Currently, a proxy to masquerade 3rd party non-HTTPS image attachments as a local HTTPS URL isn't planned at all; the time to develop, test, test security, and maintain a database would be quite cumbersome and would push the focus of what development time we have towards UBB.threads in directions that would be better focused elsewhere (such as compatibility with newer builds of PHP and MySQL, furthering web standards, UI cleanup, etc). A new tool would require parsing the database for 3rd party links, building a database of these links, writing a script to process new requests to those links, updating all previous posts for the parser, etc. Not to mention, a large (your forum is huge) forum would end up with a sizable database table to hold this additional content.

Our official stance on the matter is that the existing links in the database need to be updated, and 3rd party content reigned in (such as having users upload their images directly into their posts vs using 3rd party services, and forcing them to not have images in their signatures and to upload their avatars to your site vs hosting externally). If the 3rd party resource doesn't offer an HTTPS option, its their shortcoming.

Isaac's guide (the original post in this thread) was created to provide forum owners (who know what they're doing) with directions towards converting their forums to 100% HTTPS, anything outside of UBB.threads (such as user submitted content from 3rd party websites) falls under Step #6 of his guide:
Originally Posted by isaac
6) Update all external plugins to ensure they are HTTPS compliant (Sharaholic, Twitter, Facebook, YouTube, UBB Custom Tags, and, if your website contains non-UBB.threads content, all those internal site links - trust me you won't find them all in a single pass)


I'm not sure that anyone realizes that Isaac has donated his time to assist with the development of UBB.threads; UBBDev is contracted by UBBSystems to build one release per year, anything beyond that is complimentary and is done in our spare time. The new features you're all seeing are what we utilize on our own private forums, that we've issued out to the public (such as continued updates to my proxy/cdn user IP detection library, Stop Forum Spam, etc).

These forums are here, as they always have been, as a user to user discussion forum; the vendor (UBBSystems) does not generally frequent these forums. The only method of official support is through the UBBCentral support pages.


I am a Web Development Contractor, I do not work for UBBCentral. I have provided free User to User Support since the beginning of these support forums.
Need to Upgrade? [virtualnightclub.net]
Forums: A Gardeners Forum [agardenersforum.com] Scouters World [scoutersworld.com]
UBB.threads: UBBWiki [ubbwiki.com], UBB Styles [virtualnightclub.net], UBB.Sitemaps [virtualnightclub.net]
Longtime Supporter & Resident Post-A-Holic
VNC Web Services [virtualnightclub.net]: Code Modifications, Upgrades, Styling, Coding Services, Disaster Recovery, and more!
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262740 05/31/2019 2:09 PM
Joined: Oct 2008
Posts: 97
PianoWorld Offline
Journeyman
Offline
Journeyman
Joined: Oct 2008
Posts: 97
Thanks Gizmo,

I know how hard you and Issac work, and that we would be in deep s*** without your involvement.
I for one am very glad someone is still taking an interest in the UBB. I can't begin to imagine trying to port my forums to another platform.

I'm just trying to figure out if there is a viable way for me to convert our forums to https so our users and the SEs are happy.
There is obviously no easy answer and a good chance to make things worse.

I did find this line in your reply interesting though...

"(such as having users upload their images directly into their posts vs using 3rd party services, and forcing them to not have images in their signatures and to upload their avatars to your site vs hosting externally)"

I don't know of any way the users can upload images directly into their posts. I'd love to be able to force people to upload their pictures, storage space is relatively cheap. That would give us the https control and eliminate broken images from external links that no longer work.

However right now the only way I know is either upload into the photo gallery, grab the url, and then use the insert image link. Or link externally.


Founder/Host
Piano World
https://PianoWorld.com
Home of the world famous Piano Forums.
http://forum.PianoWorld.com
88,000+ registered members
Over 2.5 million posts, and growing...
Re: Transition Your Forum From HTTP to HTTPS [Re: PianoWorld] #262741 05/31/2019 2:18 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
Originally Posted by PianoWorld

"(such as having users upload their images directly into their posts vs using 3rd party services, and forcing them to not have images in their signatures and to upload their avatars to your site vs hosting externally)"

I don't know of any way the users can upload images directly into their posts. I'd love to be able to force people to upload their pictures, storage space is relatively cheap.


File attachments. Enable your users access to Attachment Manager. Its been part of the UBB.threads software for over a decade.

Per forum / group:
Control Panel > Permissions > Forum/Group: Max file attachments
Control Panel > Permissions > Forum/Group: Max file attachment size

Image attachments can further be processed within:
Control Panel > Master Settings > Attachments

When a user has access to attach files to their posts, they will see the "Attachment Manager" link in the Post Option section of their post.

See attached images

Attached Files 2019-05-31.png2019-05-31.png

isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes
Re: Transition Your Forum From HTTP to HTTPS [Re: isaac] #262742 05/31/2019 2:30 PM
Joined: Dec 2003
Posts: 5,898
Ruben Offline
Offline
Joined: Dec 2003
Posts: 5,898
If you follow the https guide You will find it is only changing your sites URL's.
So if someone posted a link or avatar from somewhere offsite.
Then the url would not be "forum.pianoworld.com " and not be changed
the url would then be like photobucket.com and would not be impacted.
Unless you expand on the queries in the guide.
If you do expand on the query then do them one at a time
for example youtube is https now.

Last edited by Ruben; 05/31/2019 2:52 PM.

Blue Man Group
There is no such thing as stupid questions. Just stupid answers
Re: Transition Your Forum From HTTP to HTTPS [Re: PianoWorld] #262756 06/02/2019 8:08 PM
Joined: Apr 2004
Posts: 1,413
isaac Offline OP
UBB.threads Developer
OP Offline
UBB.threads Developer
Joined: Apr 2004
Posts: 1,413
Originally Posted by PianoWorld
The standard way to fix mixed content issues like this is to make an ssl proxy for images when it’s detected that they come from insecure http. What this means is that the forum server scans URLs to see if they are insecure and then downloads the image itself and then serves it as https. I’m surprised that UBB.threads doesn’t support this out of the box (and I searched a little and doesn’t appear to) but it’s literally 5 or 6 lines of php to do this. And I like to think I’m not just an “armchair expert” as I write code for a pretty big internet company and do stuff like this a lot smile Actually I’m not sure if Frank would be comfortable but I’d be happy to make the change or provide his web developer with the info on making this change. However, this would increase bandwidth costs slightly so that could be a concern.


The serious downside to a simple proxy approach is that you are routing all external resources through your own server/systems. Which is not only a liability, but also can get rather costly. It adds complexity to the page for no good reason. It also defeats any CDNs which are suppose to route to near servers or balance to idle ones.

With a simple proxy script, anything can be included and will be delivered from your domain.

EXAMPLE:
http:// www .THEIRSITE. com/virus.jpg
WOULD BECOME:
https:// www .YOURSITE. com/?imgsrc=http:// www .THEIRSITE. com/virus.jpg

The security now becomes even worse than without the use of a pseudo-SSL proxy script. With this, your site could appear to be hosting malicious files.

Expanding on that, if a random user would copy that new SSL link with "your domain url + malicious file link" across the web, you get the "site credibility ding" for "hosting" the malicious file, even though you are only passing it through as a third party. The random user could also apply any link to the proxy tool they wanted to add.

Real-time tracking of all HTTP URLs and requesting them again if SSL connection failed is highly inefficient and overall sounds like a bad idea.

Its highly unlikely that there are going to be any core workarounds of this type written for UBB.threads, especially because the vast majority of websites today use SSL anyway, and the rest can either get on with the program or have their content treated as a second-class citizen. UBB.threads 7.7.2 provides a optional forum setting to replace hotlinked insecure embedded images with a plain URL that the end user can click through to view if they choose to.

That said, nobody is going to stop you from adding any sort workaround with custom code or server modules. good luck.


isaac @ id242.com [id242.com] // my forum @ CelicaHobby.com [celicahobby.com]
a current developer of UBB.threads php forum software // 7.7.2 Progress Notes

Additional Community Resources
UBB Developers
UBB Wiki
ShoutChat Box
Recent Topics
Error Messages - What to do???
by Daryl Fawcett - 06/20/2019 9:05 AM
Forum - Left Alignment / Margin?
by keysolutns - 06/19/2019 9:58 AM
Forum Not Working after Cpanel upgrade.
by doug - 06/14/2019 2:35 PM
YouTube does not display?
by BlackMale - 06/09/2019 6:34 AM
Removing a redirect?
by Baldeagle - 06/01/2019 4:50 PM
Who's Online Now
0 registered members (), 43 guests, and 304 spiders.
Key: Admin, Global Mod, Mod
Member Spotlight
FordDoctor
FordDoctor
New Joisey!
Posts: 289
Joined: June 2006
Show All Member Profiles 
Forum Statistics
Forums35
Topics35,303
Posts192,585
Members11,855
Most Online978
Jun 24th, 2007
Random Gallery Image
Latest Photos
Land Rocks
Cozy Places
Trees
Retreats
Powered by UBB.threads™ PHP Forum Software 7.7.2
(Snapshot build 20190623)