14 June 2017, 5:10

Seems to come from HTTP only.

http://pbs.twimg.com/profile_images/635937285163237376/mjiMUsCd_normal.jpg

This causes unnecessary warnings that the site is not secure.

Patric

14 June 2017, 11:22

Hello Patric,

Can you please provide more info on your paths? Our profile pics here and on the demo site are served correctly via https. And demo.mahara.org was a site that was switched to https last year. Thus, images were on http before but now are https. If your dataroot is correctly set to be on https your images should be served correctly unless you put the directly elsewhere outside of the dataroot.

Cheers

Kristina

15 June 2017, 6:18

Sorry... my bad.

It turns out that the Twitter block is the problem. It is retrieving the twitter account avatar from http.