Store is with SSL but getting an error

[DarkAngel]

I went through and found all manually edited http and changed it to the https, site now sports a padlock but is not green in the location bar that host says it would be after the change to https.

The entire store works as it should, there is only one http in a file that is for an offsite link which is not an https site.

When the padlock is click you get verification that it is a secure site but as mentioned the error---it appears ONLY when the merchants in the drop menu sidebox are clicked on.



How to make that merchant sidebox to show links as secure?

[DarkAngel]

I went through and found all manually edited http and changed it to the https, site now sports a padlock but is not green in the location bar that host says it would be after the change to https.

The entire store works as it should, there is only one http in a file that is for an offsite link which is not an https site.

When the padlock is click you get verification that it is a secure site but as mentioned the error---it appears ONLY when the merchants in the drop menu sidebox are clicked on.



How to make that merchant sidebox to show links as secure?

UPDATE:

I tried it in Chrome and the location bar flashes a green padlock but reverts to a document icon and the latest version of IE also shows a padlock but not green.

Both of these do say secure, like FF but it seems only FF is giving the error, NOT the other two. They go from merchant to merchant with no problems at all.

So now I wait for ideas tia.

[mc12345678]

Ideas might be more specific if the address to the affected site were provided. Otherwise I've seen browsers take issue with forms that do not maintain the page(s) secure.

As for changing the hardcoded to a revised hardcoded url, hopefully all that you did was change say http://site to //site instead of to https://

[DarkAngel]

Ideas might be more specific if the address to the affected site were provided. Otherwise I've seen browsers take issue with forms that do not maintain the page(s) secure.

As for changing the hardcoded to a revised hardcoded url, hopefully all that you did was change say http://site to //site instead of to https://

Sorry about that but taking flu meds and they just make you foggy headed...LOL

designerperfumesnob.com is where the store is located. Yes I just went into the files that were manually edited prior to her getting the SSL and did change all the links from http to the https, in other words the links we put into the file , like the redo of the sitemap all I did was add the s then saved. In all the categories, main page, sitemap, etc.

[RixStix]

I get mixed content error for the links under "Shop by Designer" and others.

(Chrome)
Mixed Content: The page at 'https://www.designerperfumesnob.com/adidas?zenid=xxxxxxxxxxxxxxxxxxx' was loaded over a secure connection, but contains a form which targets an insecure endpoint 'http://www.designerperfumesnob.com/index.php?main_page=advanced_search_result'. This endpoint should be made available over a secure connection.

Generic ZenCart observation: Are core links to category/products hardcoded automatically instead of relative? Function of template? I looked at our site/template and the links to products seem to have hardcoded <a href="http://mydomain.com/index

[DarkAngel]

I get mixed content error for the links under "Shop by Designer" and others.

(Chrome)
Mixed Content: The page at 'https://www.designerperfumesnob.com/adidas?zenid=xxxxxxxxxxxxxxxxxxx' was loaded over a secure connection, but contains a form which targets an insecure endpoint 'http://www.designerperfumesnob.com/index.php?main_page=advanced_search_result'. This endpoint should be made available over a secure connection.

Generic ZenCart observation: Are core links to category/products hardcoded automatically instead of relative? Function of template? I looked at our site/template and the links to products seem to have hardcoded <a href="http://mydomain.com/index

That is weird cause I did not get any error in the merchant sidebox for Chrome,

In IE I hover over the search button and sure enough it does not have the https in the url...need to find out where/how to fix that.

As far as I know and that is not much about coding....just enough to get by...LOL I think the entire store is hard coded link-wise, I just went through and changed all http to https in the url's that i myself entered into the documents since we wanted the links to appear in a certain order or in the categories (content area not tha products) where links were entered into the text of the products or like the main page where we used to have links but now have images that get changed out occasionally, those are now https. Things like that are the only thing I changed to be https

[DarkAngel]

ok, manufacturer side box and search (header and sidebox) both still getting the security error

how to set this to use https also.

<meta property="og:url" content="<?php echo $canonicalLink; ?>"/>

recently converted from http to https via ssl.

www.designerperfumesnob.com

she has forced the www in htaccess so this deters anyone accessing the link to leave off the www, which is better redirect

http://

to

https://www.

or forced www

[lruskauff]

Cx

ok, manufacturer side box and search (header and sidebox) both still getting the security error

how to set this to use https also.

<meta property="og:url" content="<?php echo $canonicalLink; ?>"/>

recently converted from http to https via ssl.

www.designerperfumesnob.com

she has forced the www in htaccess so this deters anyone accessing the link to leave off the www, which is better redirect

http://

to

https://www.

or forced www

Reread mc12345678 post. What he is telling you to do is change like this
"HTTPS://www.something.com/ morestuff"
To
"//www.something.com/ morestuff"

[DarkAngel]

Cx


Reread mc12345678 post. What he is telling you to do is change like this
"HTTPS://www.something.com/ morestuff"
To
"//www.something.com/ morestuff"

OK, so I did change the full urls that we edited into some files to the https full url...should I have just done what you wrote above <a href="//www.url instead of the full path?

However I did not touch the merchant sideblock nor the header or sideblock for SEARCH and they seem to be the only ones now that do not show the merchants or anything searched for as being secure.

The owner also found a site that she could enter any url to check for that error...no idea where but she said the results said that there is a form that does not show as secure...I take it to mean the search and manufacturers and do not know what file to fix it for each of those.

[RodG]

As for changing the hardcoded to a revised hardcoded url, hopefully all that you did was change say http://site to //site instead of to https://

Hopefully not too many people will follow this very bad practice.
It isn't supported by older browsers, it may not be supported by all current browsers, it introduces a needless security risk, it can play havoc with some input/output sanitisation code, and there are possibly other side effects that I've not even really considered (what if one of these protocol agnostic URL's get fed into a htaccess file that would normally force a redirect? Most such rules depend on the 'http/https' for pattern matching.
What if the agnostic url is inserted into an email, the link won't work, it will (probably) be interpreted as a 'file' request rather than http/https that was intended.
What if the original URL was to a file on an FTP site rather than a website?

There really are a lot of traps for the unwary, and what I find ironic is that in spite of the security issues, the people that feel the need to take this approach have found themselves in this position in the name of security.
If security is important then do it right, specify the desired protocol, don't leave it up to the client software to try to guess your intentions.

'Nuff said?

Cheers
RodG