Firefox SSL security warning

[wolfderby]

I've added the following code to html_output.php in 'function zen_href_link' to fix the security warning issue with firefox etc. Just thought I would post it here for anyone else. Feedback/criticism/suggestions greatly appreciated!

function zen_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true, $search_engine_safe = true, $static = false, $use_dir_ws_catalog = true) {
    global $request_type, $session_started, $http_domain, $https_domain;

if($connection=='NONSSL' && $request_type=='SSL')
{
			
	if( $page == FILENAME_ADVANCED_SEARCH_RESULT
	|| $page == FILENAME_ADVANCED_SEARCH
	|| $page == FILENAME_DEFAULT
	|| $page == FILENAME_SHOPPING_CART)
	{
		$connection = $request_type;
	}
}

..rest of function is unchanged...

-Fold

Although it seems to keep more pages secure than necessary, it seems to work for me. I prefer this over a faster site potentially perceived as insecure. Even if this code slows site performance I still think this is better. Thanks

[boardmangraham]

Sorry but would you be able to explain a little more clearly what text needs to be replaced?

At the minute in my: admin/includes/functions/html_output.php file for the text you have mentioned above I have:

// The HTML href link wrapper function
  function zen_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true) {
    global $request_type, $session_started, $http_domain, $https_domain;
    if ($page == '') {
      die('</td></tr></table></td></tr></table><br><br><font color="#ff0000"><b>Error!</b></font><br><br><b>Unable to determine the page link!<br><br>Function used:<br><br>zen_href_link(\'' . $page . '\', \'' . $parameters . '\', \'' . $connection . '\')</b>');
    }

    if ($connection == 'NONSSL') {
      $link = HTTP_SERVER . DIR_WS_ADMIN;
    } elseif ($connection == 'SSL') {
      if (ENABLE_SSL_ADMIN == 'true') {
        $link = HTTPS_SERVER . DIR_WS_HTTPS_ADMIN;
      } else {
        $link = HTTP_SERVER . DIR_WS_ADMIN;
      }
    } else {
      die('</td></tr></table></td></tr></table><br><br><font color="#ff0000"><b>Error!</b></font><br><br><b>Unable to determine connection method on a link!<br><br>Known methods: NONSSL SSL<br><br>Function used:<br><br>zen_href_link(\'' . $page . '\', \'' . $parameters . '\', \'' . $connection . '\')</b>');
    }
    if (!strstr($page, '.php')) $page .= '.php';
    if ($parameters == '') {
      $link = $link . $page;
      $separator = '?';
    } else {
      $link = $link . $page . '?' . $parameters;
      $separator = '&';
    }

    while ( (substr($link, -1) == '&') || (substr($link, -1) == '?') ) $link = substr($link, 0, -1); 

Where do I need to put the code that you mentioned in the above post?

Thanks in advance.

Graham.

[Techiescot]

Hi

I have tried the fixes mentioned in this thread but am still getting the warning on Product Info Pages but not on All Products listing.

When I first looked at the site this morning, I could not get the Create an Account page - it said Session had expired .... but about the third tome of trying it, it worked (without having made any changes.)

I have recently changed hosts and changed to SSL.

In IE, I am getting an empty cart when I add to cart. In Firefox I am getting a warning. I can add to cart from product listing pages but not from product info pages.

Please please please ... can anyone help me?

Thanks

Gillian
qualitygardenfurniture.com/store