Fix doc links in the admin settings

owncloud · Oct 23, 2019 · 1ca4786 · 1ca4786
1 parent 822f3e6
commit 1ca4786
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 3 deletions.
diff --git a/changelog/unreleased/36315 b/changelog/unreleased/36315
@@ -0,0 +1,6 @@
+Fix links in setupchecks.js
+
+Security tips at Settings -> Admin -> General had two broken links to the owncloud docs in the messages performing HTTPS and HSTS checks
+
+https://github.com/owncloud/core/pull/36315
+https://github.com/owncloud/core/issues/36238
diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js
@@ -272,6 +272,9 @@
 			var messages = [];
 
 			if (xhr.status === 200) {
+				var oc_defaults = oc_defaults || {};
+				var docPlaceholderUrl = oc_defaults.docPlaceholderUrl || '';
+
 				if(OC.getProtocol() === 'https') {
 					// Extract the value of 'Strict-Transport-Security'
 					var transportSecurityValidity = xhr.getResponseHeader('Strict-Transport-Security');
@@ -283,17 +286,21 @@
 							transportSecurityValidity = transportSecurityValidity.substring(8);
 						}
 					}
-
 					var minimumSeconds = 15552000;
 					if(isNaN(transportSecurityValidity) || transportSecurityValidity <= (minimumSeconds - 1)) {
 						messages.push({
-							msg: t('core', 'The "Strict-Transport-Security" HTTP header is not configured to at least "{seconds}" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="{docUrl}" rel="noreferrer">security tips</a>.', {'seconds': minimumSeconds, docUrl: '#admin-tips'}),
+							msg: t('core',
+								'The "Strict-Transport-Security" HTTP header is not configured to at least "{seconds}" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="{docUrl}" rel="noreferrer">security tips</a>.',
+								{'seconds': minimumSeconds, docUrl: docPlaceholderUrl.replace('PLACEHOLDER', 'enable-http-strict-transport-security')}
+								),
 							type: OC.SetupChecks.MESSAGE_TYPE_WARNING
 						});
 					}
 				} else {
 					messages.push({
-						msg: t('core', 'You are accessing this site via HTTP. We strongly suggest you configure your server to require using HTTPS instead as described in our <a href="{docUrl}">security tips</a>.', {docUrl: '#admin-tips'}),
+						msg: t('core',
+							'You are accessing this site via HTTP. We strongly suggest you configure your server to require using HTTPS instead as described in our <a href="{docUrl}">security tips</a>.',
+							{docUrl: docPlaceholderUrl.replace('PLACEHOLDER', 'use-https')}),
 						type: OC.SetupChecks.MESSAGE_TYPE_WARNING
 					});
 				}