skip img prox if not hosted on https

README.md

@@ -366,7 +366,7 @@ _all admin calls require auth and admin privilege_
 * Each site stored in a separate boltbd file.
 * In order to migrate/move remark42 to another host boltbd files should be transferred.
 * Automatic backup process runs every 24h and exports all content in json-like format to `backup-remark-YYYYMMDD.gz`.
-* Sessions implemented with [gorilla/sessions](https://github.com/gorilla/sessions) and file-system store under `SESSION_STORE` path. It uses HttpOnly, secure cookies.
+* Authentication implemented with [jwt](https://github.com/dgrijalva/jwt-go) stored in a cookie. It uses HttpOnly, secure cookies.
 * All heavy REST calls cached internally, default expiration 4h
 * User's activity throttled globally (up to 1000 simultaneous requests) and limited locally (per user, up to 10 req/sec)
 * Request timeout set to 60sec

app/rest/auth/provider.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/sha1"
-	"encoding/gob"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -209,7 +208,3 @@ func (p Provider) randToken() string {
 	}
 	return fmt.Sprintf("%x", s.Sum(nil))
 }
-
-func init() {
-	gob.Register(store.User{})
-}

app/rest/proxy/image.go

@@ -24,9 +24,10 @@ type Image struct {
 
 // Convert all img src links without https to proxied links
 func (p Image) Convert(commentHTML string) string {
-	if !p.Enabled {
+	if !p.Enabled || strings.HasPrefix(p.RemarkURL, "http://") {
 		return commentHTML
 	}
+
 	imgs, err := p.extract(commentHTML)
 	if err != nil {
 		return commentHTML
@@ -108,10 +109,12 @@ func (p Image) extract(commentHTML string) ([]string, error) {
 
 // replace img links in commentHTML with route to proxy with base64 encoded original link
 func (p Image) replace(commentHTML string, imgs []string) string {
+
 	for _, img := range imgs {
 		encodedImgURL := base64.URLEncoding.EncodeToString([]byte(img))
 		resImgURL := p.RemarkURL + p.RoutePath + "?src=" + encodedImgURL
 		commentHTML = strings.Replace(commentHTML, img, resImgURL, -1)
 	}
+
 	return commentHTML
 }