Repository: freedomofpress/securedrop

Issue:
Tor2web warning page still using outdated pre-SI-redesign resources
## Description

In the SI redesign, we overlooked the Tor2web page which tries to render an old location for the icon and does not show an icon for the flash warning message.

## Steps to Reproduce

Visit https://demo-source.securedrop.org/tor2web-warning

## Expected Behavior

![image](https://user-images.githubusercontent.com/201369/166803350-c246a3f4-b648-4787-9e41-d4ba4b39385f.png)

## Actual Behavior

![image](https://user-images.githubusercontent.com/201369/166803550-cb4e380f-7da9-402b-9668-e4605af3f1e5.png)

"Tor Browser" link in tor2web warning is broken
## Description

The "Tor Browser" link in the tor2web warning is broken because it does not specify a protocol, so the browser treats it as a relative link.

## Steps to Reproduce

* Visit `/tor2web-warning` in the SI
* Hover over or click on the "Tor Browser" link, it should send you to a non-existent `/www.torproject.org/projects/torbrowser.html` on the SI's domain.

## Expected Behavior

* Link takes you to Tor Project website.

## Comments

Fix should be as simple as adding "https://" in front.



Discussion:

Given that this link is gonna be on a tor2web-proxied page potentially with analytics, maybe we shouldn't even have it.
I do think we need a way to direct them into the Tor network.

Maybe we include it as a plaintext link, like we do the onion address, so basic click tracking analytics hopefully wouldn't pick it up (but maybe fancy clipboard tracking would??).


![Screenshot 2022-04-11 at 18-18-55 SecureDrop Protecting Journalists and Sources](https://user-images.githubusercontent.com/81392/162842717-1d9e174d-1513-4f9a-8f8c-d3c550f6f0d3.png)

Or alternatively:

![Screenshot 2022-04-11 at 18-23-26 SecureDrop Protecting Journalists and Sources](https://user-images.githubusercontent.com/81392/162843197-78727015-4350-44b8-b434-6f3ba570f3af.png)


@tina-ux if you have any suggestions here. For background, this is the warning we show when we detect that users are using a "Tor2Web" proxy to access the Source Interface, which deanonymizes them and often these proxies have trackers like Google Analytics, etc. So we want to make sure if they haven't already, download Tor Browser, and then provide them with the correct Onion URL.
There are existing strings describing how to get Tor Browser (including the email option? is that still a thing?) in  `source_templates/use-tor-browser.html` - it might make sense to reuse them (either cutting and pasting or adding an include to both templates) so as to reduce translation overhead.

Resolving patch:
diff --git a/securedrop/source_app/info.py b/securedrop/source_app/info.py
--- a/securedrop/source_app/info.py
+++ b/securedrop/source_app/info.py
@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 import flask
-from flask import Blueprint, render_template, send_file, redirect, url_for, flash
+from flask import Blueprint, render_template, send_file, redirect, url_for
 from flask_babel import gettext
 import werkzeug
 
@@ -8,7 +8,7 @@
 
 from encryption import EncryptionManager
 from sdconfig import SDConfig
-from source_app.utils import get_sourcev3_url
+from source_app.utils import get_sourcev3_url, flash_msg
 
 
 def make_blueprint(config: SDConfig) -> Blueprint:
@@ -16,7 +16,7 @@ def make_blueprint(config: SDConfig) -> Blueprint:
 
     @view.route('/tor2web-warning')
     def tor2web_warning() -> flask.Response:
-        flash(gettext("Your connection is not anonymous right now!"), "error")
+        flash_msg("error", None, gettext("Your connection is not anonymous right now!"))
         return flask.Response(
             render_template("tor2web-warning.html", source_url=get_sourcev3_url()),
             403)


Test patch: