Emails sent from noreply@tracker.pureos.net contain HTTP links to tracker.pureos.net, thus vulnerable to MITM attacks when clicked.
Examples:
1. in notifications of tasks:
TASK DETAIL
http://tracker.pureos.net/T118
EMAIL PREFERENCES
http://tracker.pureos.net/settings/panel/emailpreferences/
2. in email verification link sent to new user that done registration.
> Please verify that you own this email address (...........) by clicking this link: http://tracker.pureos.net/emailverify/xl............./
Fix:
Change settings in tracker to use HTTPS links instead of HTTP, probably can acomplished by:
1. a restart by "phd restart" may fix it, in case it's happening due to caching? see at:
https://secure.phabricator.com/T10848 [Notification mails containing old links after changing phabricator.base-uri]
2. The code path of first example use 'phabricator.production-uri' config to determinate the URI to use, so set it in configuration with https URI, which can be done by command:
./bin/config set phabricator.production-uri HTTPSURIVALUE
where HTTPSURIVALUE is result of ./bin/config get phabricator.base-uri