Download links not working

[xchem]

Download links not working

[duncanpeacock]

Update:

Still looking into this, but it's slow because I can only reproduce it in my stack (downloads always work from Chrome on my laptop) so I have to rebuild it each time.

Some extra information:

1. This issue only occurs with the latest (post July I think) versions of Chrome - which has some increased security settings - so it was an existing issue that has come to light.
2. The links in the DRF target api query page work OK in Firefox.
3. If you cut and paste the link from the DRF target api query to a browser window in Chrome it works.
4. If you use the API uploader page (upload_tset), the target link that is created also works in Chrome.

The redirect issue in Django Rest Framework is known about and I've been trying some of the nginx cofig changes to try to get it working. Unfortunately the simple fix I tried (as described here: https://djangodeployment.com/2017/01/24/fix-djangos-https-redirects-nginx/) does not seem to work - although I'm trying a couple more settings.

This post: https://serverfault.com/questions/659029/how-to-solve-nginx-reverse-proxy-mixed-contenthttp-https/853237
also recommends:
"
You have to go through the sites' code, and replace all ocurences of http://domain.com/resource with either /resource or //domain.com/resource.
This ensures that all the dependent web page resources are loaded with the same protocol as the website itself is loaded.
"

What seems a bit strange to me is that the loader code already seems to be trying to get a relative address, so I could fix this but the problem with this approach is that you wouldn't get clickable links in DRF.

Instead of a complete link like:
http://fragalysis-duncan-default.xchem-dev.diamond.ac.uk/media/targets/Mpro.zip
you'd get a relative (none-clickable) link like the one for the template file. E.g.
/media/targets/Mpro.zip

What may be worth a try is to change the
http://fragalysis-duncan-default.xchem-dev.diamond.ac.uk/media/targets/Mpro.zip
to
https://fragalysis-duncan-default.xchem-dev.diamond.ac.uk/media/targets/Mpro.zip
and see what happens..

[duncanpeacock]

I have a fix under branch: issue-226-download.
This has been tested successfully with my stack: fragalysis-duncan-default.xchem-dev.diamond.ac.uk (you can accept the unsigned certificate).

The solution basically replaces the http with the https.
The nginx parameters all seem to be set up properly, and for this limited use there doesn't seem to be any security issues. It seems to be more of an issue about how django constructs URLs from filefields in the DRF serializer.

Anyway, I'll get this reviewed on Tuesday and then create a pull request.