File previewers and other areas of the code do not work if Dataverse server is under http (not https)

[juancorr]

Access to file previewers fail when Dataverse server (the server with the file to preview) is under http and not under https.

Dataverse code is taking the site url from the SystemConfig.getDataverseSiteUrlStatic method (with the code hostUrl = "https://" + hostName;) and not paying attention to the toolURL parameter in the externaltool table in the database.

[djbrooke]

Hey @juancorr, apologies if I'm misunderstanding, but I know that we strongly recommend https:

http://guides.dataverse.org/en/latest/installation/config.html#forcing-https

I'm not sure if the right answer here is:

• Updating this to allow http
• if this and other areas of the application code are expecting https, updating our docs to say that HTTPs is required
• Other?

I'll let someone more technical than me provide a better answer here.

[pdurbin]

I think @juancorr has a good point. At a high level we do want to encourage HTTPS but I've run into this problem too. @donsizemore helped me out a done by enabling certs and HTTPS in dataverse-ansible so I could easily demo Data Explorer and File Previewers.

All that said, the fix would be to revisit the logic at https://github.com/IQSS/dataverse/blob/v4.17/src/main/java/edu/harvard/iq/dataverse/util/SystemConfig.java#L339 and I'll post a screenshot for the coders since there's isn't all that much code:

[poikilotherm]

Please stay compatible with plain HTTP. Demo sites, test installation etc might not be using HTTPS, but want to test previewers.

Developing with a hard dependcy on HTTPS is a burden, too.

[juancorr]

Thanks pdurbin, another subject is that the local URL parameter put by the curl command in the database is ignored. El lun., 21 oct. 2019 19:20, Philip Durbin <notifications@github.com> escribió:

…

I think @juancorr <https://github.com/juancorr> has a good point. At a high level we do want to encourage HTTPS but I've run into this problem too. @donsizemore <https://github.com/donsizemore> helped me out a done by enabling certs and HTTPS in dataverse-ansible so I could easily demo Data Explorer and File Previewers. All that said, the fix would be to revisit the logic at https://github.com/IQSS/dataverse/blob/v4.17/src/main/java/edu/harvard/iq/dataverse/util/SystemConfig.java#L339 and I'll post a screenshot for the coders since there's isn't all that much code: [image: Screen Shot 2019-10-21 at 1 17 08 PM] <https://user-images.githubusercontent.com/21006/67227527-66e7ec80-f405-11e9-8cd1-e4dd2a580d9c.png> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6296?email_source=notifications&email_token=AACPSCGR66E3YUAORA6XQ6TQPXQELA5CNFSM4JC7T4J2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEB3DJPQ#issuecomment-544617662>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACPSCBAFACWS5VVZERTNT3QPXQELANCNFSM4JC7T4JQ> .

[djbrooke]

Thanks @pdurbin @poikilotherm @juancorr. Sounds like we'll not want to take the path of requiring https :)

[sekmiller]

@juancorr we took a look at this issue, and there doesn't seem to be a problem with the dataverse code. It's properly using the toolUrl from the external tool and passing a proper url for the file. The issue that we have seen is that when you use the version of the tool hosted at GitHub such as ( https://qualitativedatarepository.github.io/dataverse-previewers/previewers/SpreadsheetPreview.html) and pass it a file from your http://LocalHost it fails, but only in Safari. it is successful in FireFox and Chrome.

What browser are you using? (and which version and OS)?

Also, if we cloned the QDR repo and served it locally it works in Safari as well.