View PDF Macro in Office Connector makes http fetch from Adobe from https session

2011-09-07T22:10:56
ID ATLASSIAN:CONF-23182
Type atlassian
Reporter mstobbs@ucar.edu
Modified 2017-02-17T05:22:37

Description

The View PDF macro within the Office Connector plugin provides the following http URL even for https sessions when a user's browser fails the Flash installed test.

http://www.adobe.com/images/shared/download_buttons/get_flash_player.gif

It's bad form to mix http urls in with secured https sessions and can also lead to confusing mixed protocol warnings to users. Adobe supports the URL above via https as well so honoring the current protocol in all subsidiary requests should be an easy fix (recommend you look at this across other plugins as well). Atlassian may also want to consider providing a macro configuration option for a sysadmin to specify a local path to the get flash player gif. This would prevent Adobe from logging the referrer URL which includes the Confluence page title. Protected wiki page titles can be sensitive to privacy concerns on occasion.