Merge lp:~jbicha/ubuntu-archive-tools/fix-mixed-https-content into lp:ubuntu-archive-tools

[Jeremy Bícha]

The Ubuntu Archive reports can be viewed over https like at
https://people.canonical.com/~ubuntu-archive/nbs.html

But the chart at the bottom of the page doesn't load.

Firefox's Console in the Developer Tools shows this error:

  Blocked loading mixed active content “http://yui.yahooapis.com/3.17.2/build/yui/yui-min.js”

Chromium also has the problem and shows a similar error in its Console.

I haven't tested this but I think this should work. Yahoo appears to not serve YUI over HTTPS so I'm pointing to the CloudFlare mirror instead.

[Steve Langasek (vorlon)]

The yui.yahooapis.com hostname is part of the api. Why is it correct to replace this hostname with cloudflare?

review: Needs Information

[Steve Langasek (vorlon)]

To be clear: "Yahoo isn't providing this over HTTPS, but here's a URL that is HTTPS and seems to be stable" is not a good justification.

[Colin Watson (cjwatson)]

I'd suggest that we should self-host the necessary file(s) instead.

[Jeremy Bícha (jbicha)]

Or you could use

https://yui-s.yahooapis.com/3.17.2/build/yui/yui-min.js

[Steve Langasek (vorlon)]

Confirmed that https://yui-s.yahooapis.com/3.17.2/build/yui/yui-min.js now exists so switching to that and considering this merged

review: Approve

=== modified file 'charts.py'
--- charts.py	2015-03-10 14:37:48 +0000
+++ charts.py	2018-01-17 22:50:06 +0000
@@ -31,7 +31,7 @@
                 height: %(height)dpx;
             }
         </style>
-        <script src="http://yui.yahooapis.com/3.17.2/build/yui/yui-min.js">
+        <script src="https://cdnjs.cloudflare.com/ajax/libs/yui/3.17.2/yui/yui-min.js">
         </script>
         """) % params