fedora-websites

#583 Users with disabled javascript should get a link to verification hash near the download link on getfedora.org
Closed: Fixed Opened by jenslody.

Closed: Fixed
Reopen Issue

If users have disabled javascript they can directly download the installation images, without getting a link to the verification-site.
See the discussion here: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/DAVQV72GEODAGDPIA6O3CM6RBQK7VDQ4/

Besides the discussion what happens, if the server get hacked and how to secure the hashes, it should not be less insecure, if the users have turned off javascript (mostly for security reasons), sd with javascript turned on.

A probable (and cheap) change would be to add a link on the download-pages.

I add a patch that needs to be verified, I'm not sure about the styles and what happens, if javascript is enabled.
I don't know a way to test it without setting up a complete webserver.
I only tested injection into the html-code for the workstation-image inside firefox and it seems to work.

Add link to verification.html, even if javascript is disabled
add-static-link-to-verify-20160223.patch

Hi jenslody,

most of the users when downloading a Fedora image, will get a very prominent link with the right checksum file for the image they are going to download. This is done with a small script and needs to have JS enabled to work, right.[[br]]
We don't want to have verify links on the download page, because people will need the checksum file only if they really download an image. Therefore we have it only on the download-splash pages.

For those who prefer keeping JS disabled I added a link which appears only if you are not using JS and pushed it to staging. Could you please try it out and let us know if this would be acceptable? If yes, we need to make the same changes also for labs.fp.o and spins.fp.o.

Here is the link to the staging website: https://stg.getfedora.org

Thanks.

Thank you for the quick response.

From my point of view it's absolutely acceptable.

Jens

Ok thank you. Pushed to stable, also for labs and spins. Will be live in about 40 minutes. See ref 43ed767 and 359954f.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.