Security warning when search right after log in

[cochlear]

This problem is different to that discussed in the "This page contains both secure and nonsecure items" FAQ.

Right after I log in (over SSL), if I do a search, FF2, FF3, and Opera (amazingly not IE this time) give me a security warning as below:

Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Are you sure you want to continue sending this information?

Search is normally non-SSL, so I guess that warning makes sense.

But this warning does not occur if I do: log in --> click a category. Obvously this is much more desirable.

I would really like this sorted out. So please, anyone, help!

I can duplicate this on the classic template, so I'm "assuming" this comes with ZC 1.3.8a.

[kobra]

Where can this be seen?

Not generally part of Zen Cart as there are many many installs not throwing this error

[ink]

Hi Cochlear

Same problem here dude.......Firstly I am no code Guru, everthing I have doctored I've had to poke around with for hours.....no years literally to achieve what I want!

I think you are obviously right in terms of it being a Firefox etc problem. I also think it would help to make the target of the form secure. Maybe with some sort of if condition to only do that if the existing page is https?

On my site on page tpl_product_info_display.php I have the code:

<?php echo zen_draw_form('cart_quantity', zen_href_link(zen_get_info_page($_GET['products_id']), zen_get_all_get_params(array('action')) . 'action=add_product'), 'post', 'enctype="multipart/form-data"') . "\n";


I am sure this is what needs doctoring and that these code experts which hang about on this forum could solve this problem in a few minutes. Having said that I will try and solve the problem and get back to you as I know they are very busy people and do their best to solve everybodies problems.

All this said and done I could be 'barking up the wrong tree' so it would be good if someone in the know could point us in the right direction.

[Website Rob]

This would be classified as a Browser specific problem. Zen Cart is operating exactly as it should; when login is over SSL as all Search functions use a non-SSL connection.

Some Browsers, like Mozilla, FF, Opera, have a Default setting to warn when information entered into a form using an SSL connection will return results using a non-SSL connection. Turn that setting to OFF and msg. goes away.

Something for the Zen Cart Developers to think about for upcoming versions but not sure what can done about it now.

[ink]

when login is over SSL as all Search functions use a non-SSL connection.

That is a bummer. As we all know any sort of 'security' problem freaks a percentage of uneasy people out.

Let's remember these are people who are moments away from giving their card details over, and messages such as

the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Translates into "if you put your card details in this website your account will be empty by the morning!"

[Website Rob]

Not sure where you get that from?

Checkout pages are done using SSL (if enabled) and there is no such error msg.