Unsecure items in SSL pages

[schoolboy]

When a host makes errors such as this, and then tries to tell you that it's something YOU are doing, then it's time to find a better host.

[Quedex]

Update* I still have to run the site fully behind the SSL as i still get " i see non ssl" from the above script

my server guys are telling me this....

When you access an atlas site over SSL, we set the variable X-Forwarded-SSL to 1 and SSL is set to 1

i have no idea wot this means any info on this would be appreciated !

many thanks

[DrByte]

You could try updating the /includes/init_includes/init_file_db.php file by adding 2 extra lines, as shown below:

$request_type = (((isset($_SERVER['HTTPS']) && (strtolower($_SERVER['HTTPS']) == 'on' || $_SERVER['HTTPS'] == '1'))) ||
                 (isset($_SERVER['HTTP_X_FORWARDED_BY']) && strpos(strtoupper($_SERVER['HTTP_X_FORWARDED_BY']), 'SSL') !== false) ||
                 (isset($_SERVER['HTTP_X_FORWARDED_HOST']) && (strpos(strtoupper($_SERVER['HTTP_X_FORWARDED_HOST']), 'SSL') !== false || strpos(strtoupper($_SERVER['HTTP_X_FORWARDED_HOST']), str_replace('https://', '', HTTPS_SERVER)) !== false)) ||
                 (isset($_SERVER['SCRIPT_URI']) && strtolower(substr($_SERVER['SCRIPT_URI'], 0, 6)) == 'https:') ||
                 (isset($_SERVER['HTTP_X_FORWARDED_SSL']) && ($_SERVER['HTTP_X_FORWARDED_SSL'] == '1' || strtolower($_SERVER['HTTP_X_FORWARDED_SSL']) == 'on')) ||
                 (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && (strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'ssl' || strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'https')) ||
                 (isset($_SERVER['HTTP_SSLSESSIONID']) && $_SERVER['HTTP_SSLSESSIONID'] != '') ||
                 (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443')) ? 'SSL' : 'NONSSL';

This is included in v1.3.9d

[vinewebs]

Info for Network Solutions clients. Network Solutions will not allow the php script in Zen-Cart to detect SSL called pages. Here is a quote from a Network Solutions staff member on the NS user forums. Yet another reason to not use Network Solutions to host your Zen-Cart site.

Our proxy SSL doesn't allow server-side variables to detect HTTPS (secure). All server-side coding will always detect HTTP (non-secure), and for programs that attempt to redirect non-secure connections (http://) to a secure connection (https://) will result in an infinite loop and server error after 30 seconds.

The only ways around this is to
assume the connection is secure by making all the links to the sensitive pages https, or

use a client-side program (like javascript) to detect if it's secure and redirect if it's not. The coding below will do just that. Just modify it to redirect to the correct secure domain and add it into the HTML of any sensitive pages.

http://forums.networksolutions.com/i...ndpost&p=27418

[Kim]

vinewbs - are you saying you are hosted on NetSol?

[vinewebs]

Yes, this site is on NetSol, not by choice, though. My client's non-ZenCart site was on NetSol prior to my converting it to a Zen-Cart. I have been discovering the NetSol issues since launching the site a week ago. Wish I had known about all the issues before; I would have recommended my client change hosts before we launched.

[hovsepations]

@vinewebs; did you find a solutions to your problem?

i'm trying to setup the SSL from Network Solutions hosted on HostUpOn, but they both say that everything is setup right, and that the problem is with zencart, does that make sense to anyone?