Hard coded for http

Good point. Do you know of a way to detect whether a site is using HTTP or HTTPS?

Gabe

according to https://php.net/manual/en/reserved.variables.server.php $_SERVER[‘HTTPS’] will be set if it’s https

There’s also a note on that page to escape REQUEST_URI to avoid a XSS vulnerability htmlspecialchars($_SERVER[‘REQUEST_URI’]);

Great, thanks! Will roll this into a new release in the coming week or so.

I’ve made a new beta version that should fix the problem.

It would be great if you could download it and test it out:

https://dl.dropbox.com/u/15414097/friends-only-beta.zip

Thanks!

Gabe