Firefox SSL security warning

[Merlinpa1969]

I have seen this error and have verified it in several other sites

and just verified it with a brand new ZC 1.3.7

good catch

[netbouy]

Just tried the site with the classic template and got the same same security warning as with my own template.

Great to hear I am not losing my mind... I was just off to test the same thing on a some sites in the showcase but you beat me to it...

Thanks for your help Merlinpa1969

[netbouy]

This definitely appears to be an oversight so I have posted it in the bug reports here

[Ajeh]

This really isn't a bug but rather a need for preferrence ...

The submit forms can be set to go secure to secure or adapt a different approach and have the forms vanish from secure pages or change to a link to the non-secure page to prevent warnings of processing data between secure and non-secure pages ...

[netbouy]

I understand what you are saying but due to the fact that this is a shopping cart and should be used with a secure connection on all production sites, it would make sense that the side boxes etc are able to determine which type of connection they are on and adjust themselves accordingly.

I have taken a look at a number of other ZC sites and they all do the same thing with Firefox and an https connection... generate a warning message. This tells me that this is actually a wide-spread issue and one that could be quite simply eliminated.

I am new to ZC so I'm not going to pretend I understand that much about it, but this does in fact appear to be a browser specific bug (or should we call it an abnormality?).

I agree that this is not a ZC bug, but more of a Firefox fix and it may be easier to correct this in ZC than Firefox.

[Ajeh]

I call it an undesireable feature ...

Yes this can be altered to prevent the warnings ...

Change in the form the SSL/NONSSL to $request_type ...

NOTE: this will need to be tested on your site ...

[Merlinpa1969]

Ok Linda to keep this all in one thread,

I have acustomer that gets to checkout ( secure page ) they say self and self says Huh ,
I outta see if they also have that green doo dad

they hit the search box in the header and now they are NOT sure that they want to buy cause they see this neat security warning.

with your "fix" the customer dosnt even have the search box to loog for the doodad so now we have lost an add on sale......


See the way this is going.........

[netbouy]

I completely agree with you if that was the situation.

I am not suggesting that anything be removed, just fixed.

This means the search box is available on the https login page,
The customer conducts their search without getting a warning message
The sale is made (hopefully).

However, scenario number 2...
The customer goes to login but thinks "hmmm, I wonder if they sell green blankets in the store?".
The search box is there so they type in "green blankets" but get a security warning message.
This makes them think "not too sure about this... why am I being warned? maybe I shouldn't shop here if the store is not secure?"

Get my drift... ?

[Ajeh]

Don't forget ... on fixing this you have to follow the full circle of files ...

Anyone that can be touched via a submit has to have the $request_type added ... plus it would not be a bad idea for a safety on the $request_type should it not set right because of your server settings ...

I have not found anything that does not pick this up right at the moment ... but again, another reason to hold off at this time ...

This is about 20+ files ...

All sideboxes with a form/submit

Product Listing and all dropdowns that might display ...

All of the product _info pages ...

Shopping Cart ...

etc. etc. etc.

Otherwise, you only half fix the secure warning ...

We know this is an undesireable feature ... and it will be addressed in a future release ...

Right now, it is too many template files to touch for a bugfix release ...

[Ajeh]

Ok Linda to keep this all in one thread,

I have acustomer that gets to checkout ( secure page ) they say self and self says Huh ,
I outta see if they also have that green doo dad

they hit the search box in the header and now they are NOT sure that they want to buy cause they see this neat security warning.

with your "fix" the customer dosnt even have the search box to loog for the doodad so now we have lost an add on sale......


See the way this is going.........

Again there are several ways to fix this ... adding the $request_type to all form/submits is the simple solution ...

Example tpl_search_header.php change to:

  $content .= zen_draw_form('quick_find_header', zen_href_link(FILENAME_ADVANCED_SEARCH_RESULT, '', $request_type, false), 'get'); 

And don't forget the other 20+ files that also must be addressed ...