Icons for issue types loaded via HTTPS not displayed in some screens

An icon for an issue type which uses and absolute path URL will not be displayed in the following screens under these circumstances:

• the icon is served over SSL, i.e. the URL starts with "https://"

AND

• the JIRA instance contains a context path (e.g. /jira)

The screens affected are:

• Administration > Issue Types
• Create Issue screen for entering the details of the issue (i.e. containing all the fields)

This happens because the image URL is appended to the context path. That is:

<img src="/jirahttps://www.acme.com.au/path/images/icon.gif"

The culprit is the following code in templates/standard/constanticon.jsp:

<webwork:if test="./parameters['iconurl']/startsWith('http://') == true">
<img src="<webwork:property value="./parameters['iconurl']" />" height=16 width=16 border=0 align=absmiddle alt="<webwork:property value="./parameters['alt']" escape="false" />" title="<webwork:property value="./parameters['title']" escape="false" />">
</webwork:if>
<webwork:else>
<img src="<webwork:property value="./parameters['contextPath']" /><webwork:property value="./parameters['iconurl']" />" height=16 width=16 border=0 align=absmiddle alt="<webwork:property value="./parameters['alt']" escape="false" />" title="<webwork:property value="./parameters['title']" escape="false"/>">

We are testing for absolute URLs starting with "http://", but not those starting with "https://".

The problem is fixed if you change the first line to:

<webwork:if test="./parameters['iconurl']/startsWith('http://') == true || ./parameters['iconurl']/startsWith('https://') == true">

The following screens are not affected. That is, the image icons display correctly without the above modification:

• Modify Issue Types Scheme admin screen
• The initial Create Issue screen where the user chooses issue type
• Browse Issue
• Find Issues, both in left hand column and in results on the right

Finally, an example of when the image is served over SSL is when it is a separate icon website, and the JIRA instance has to run over SSL, and as such the icon website must be served over SSL to stop Internet Explorer displaying a "Insecure content in secure page" warning message.