WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 4 years ago

Last modified 4 years ago

#41984 closed enhancement (fixed)

Imgur API requires SSL

Reported by: GunGeekATX Owned by: dd32
Milestone: 4.9 Priority: normal
Severity: normal Version:
Component: Embeds Keywords: has-patch commit
Focuses: Cc:

Description

The Imgur API URL currently in core is http://api.imgur.com/oembed but it now requires SSL.

http://api.imgur.com/oembed?maxwidth=525&maxheight=788&url=https%3A%2F%2Fimgur.com%2FTJ8UIuP&format=json

{
    "data": {
        "error": "HTTP Access is disabled. Requests must use SSL (HTTPS)."
    },
    "success": false,
    "status": 400
}

Attachments (1)

41984.diff (1.3 KB) - added by swissspidy 4 years ago.

Download all attachments as: .zip

Change History (9)

#1 @danieltj
4 years ago

  • Keywords reporter-feedback added

This seems to be working by design, no? The URL you've included returns the following JSON response for me:

{"version":"1.0","type":"rich","provider_name":"Imgur","provider_url":"https:\/\/imgur.com","width":525,"height":788,"html":"<blockquote class=\"imgur-embed-pub\" lang=\"en\" data-id=\"TJ8UIuP\"><a href=\"https:\/\/imgur.com\/TJ8UIuP\">View post on imgur.com<\/a><\/blockquote><script async src=\"\/\/s.imgur.com\/min\/embed.js\" charset=\"utf-8\"><\/script>"}

Did you try adding an image in the WYSIWYG editor or the above link?

#2 @GunGeekATX
4 years ago

Give it a try with curl or wget. In Chrome, I noticed it automatically redirecting.

vagrant@vvv:/srv/www/wordpress-default$ wget http://api.imgur.com/oembed?maxwidth=525&maxheight=788&url=https%3A%2F%2Fimgur.com%2FTJ8UIuP&format=json
[1] 26635
[2] 26636
[3] 26637
vagrant@vvv:/srv/www/wordpress-default$ --2017-09-25 14:41:34--  http://api.imgur.com/oembed?maxwidth=525
Resolving api.imgur.com (api.imgur.com)... 151.101.48.193
Connecting to api.imgur.com (api.imgur.com)|151.101.48.193|:80... connected.
HTTP request sent, awaiting response... 400 Unknown Error
2017-09-25 14:41:34 ERROR 400: Unknown Error.

#3 @dd32
4 years ago

  • Keywords reporter-feedback removed
  • Milestone changed from Awaiting Review to 4.9

Changing the API url to https:// seems good, and required. The HTTP api is definitely unresponsive.

A note for testing, api.imgur.com seems to have a 403 Permission Denied response for any user-agents containing 'wordpress' (specifically in lower-case) anywhere in it's string. Sent me on a bit of a wild goose chase.

@swissspidy
4 years ago

#4 @swissspidy
4 years ago

  • Keywords has-patch commit added
  • Type changed from defect (bug) to enhancement
  • Version trunk deleted

#5 @dd32
4 years ago

  • Owner set to dd32
  • Resolution set to fixed
  • Status changed from new to closed

In 41599:

Embeds: Switch the Imgur oEmbed endpoint to use SSL as the HTTP version has been deprecated.

Props swissspidy.
Fixes #41984.

#6 @GunGeekATX
4 years ago

Thanks. Related to this, Imgur also has albums and galleries which can be embedded. I've added these to the current project I'm working on (which is how I noticed the https issue). I can open a new ticket and patch if sounds like something that should be supported in core.

// Add providers for albums and galleries.
$providers['#https?://(.+\.)?imgur\.com/a/.*#i'] = array(
	'https://api.imgur.com/oembed',
	true,
);

$providers['#https?://(.+\.)?imgur\.com/gallery/.*#i'] = array(
	'https://api.imgur.com/oembed',
	true,
);

Examples:
https://imgur.com/a/frTsT
https://imgur.com/gallery/11TsUHK

#7 follow-up: @dd32
4 years ago

@GunGeekATX Albums and Galleries are both supported by the core regex :) Due to the HTTP breakage you probably didn't notice.
For reference, the existing regex '#https?://(.+\.)?imgur\.com/.*#i' captures all imgur subdomains and paths.

#8 in reply to: ↑ 7 @GunGeekATX
4 years ago

Replying to dd32:

@GunGeekATX Albums and Galleries are both supported by the core regex :) Due to the HTTP breakage you probably didn't notice.
For reference, the existing regex '#https?://(.+\.)?imgur\.com/.*#i' captures all imgur subdomains and paths.

Ah yes, it does indeed (.*). Thanks!

Note: See TracTickets for help on using tickets.