diff --git a/DNN Platform/Library/Common/Utilities/UrlUtils.cs b/DNN Platform/Library/Common/Utilities/UrlUtils.cs index 545ce9b5bfd..45b673fd3b9 100644 --- a/DNN Platform/Library/Common/Utilities/UrlUtils.cs +++ b/DNN Platform/Library/Common/Utilities/UrlUtils.cs @@ -400,6 +400,11 @@ public static bool InPopUp() return HttpContext.Current != null && HttpContext.Current.Request.Url.ToString().IndexOf("popUp=true", StringComparison.OrdinalIgnoreCase) >= 0; } + public static bool IsPopUp(string url) + { + return url .IndexOf("popUp=true", StringComparison.OrdinalIgnoreCase) >= 0; + } + /// /// Redirect current response to 404 error page or output 404 content if error page not defined. /// diff --git a/DNN Platform/Library/Entities/Urls/AdvancedUrlRewriter.cs b/DNN Platform/Library/Entities/Urls/AdvancedUrlRewriter.cs index 8604a5fdd95..830cdb2ece5 100644 --- a/DNN Platform/Library/Entities/Urls/AdvancedUrlRewriter.cs +++ b/DNN Platform/Library/Entities/Urls/AdvancedUrlRewriter.cs @@ -1554,8 +1554,11 @@ private bool CheckForSecureRedirect(PortalSettings portalSettings, //check ssl enforced if (portalSettings.SSLEnforced) { - //check page is not secure, connection is secure - if (!portalSettings.ActiveTab.IsSecure && result.IsSecureConnection) + // Prevent browser's mixed-content error in case we open a secure PopUp or a secure iframe + // from an unsecure page + if (!portalSettings.ActiveTab.IsSecure && + result.IsSecureConnection && + !UrlUtils.IsPopUp(url)) { //has connection already been forced to secure? if (queryStringCol["ssl"] == null)