partially encrypted login SSL - v1.3.8, using proxy server

Hi There,

My Login page is partially encrypted I double checked for any hot links but none.

https://www.sportslabstores.com.au/index.php?main_page=login

It is sitting in a Linux Centos machine. my Virtualhosting settings also seems to be fine.

Could someone advice me on what I am doing wrong.

Thanks.

Hi There,

I went through zencart forums and did the SSL test. Could some one please explain me the issue with the result i have bellow.

Array
(
[HTTP_HOST] => https://www.sportslabstores.com.au
[HTTP_X_REAL_IP] => 203.XXXX.XXXX.XXXX
[HTTP_X_FORWARDED_FOR] => 203.XXX.XXXX.XXXX
[HTTP_CONNECTION] => close
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0
[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip, deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_COOKIE] => zenid=eh4ege89uqf75js83s7fc7ntq3; __utma=51135595.1869370263.1312875994.1312875994.1312875994.1; __utmb=51135595.3.10.1312875994; __utmc=51135595; __utmz=51135595.1312875994.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); zenAdminID=kqnjjikhlrjkn79hk50ckg75k6
[PATH] => /sbin:/usr/sbin:/bin:/usr/bin
[SERVER_SIGNATURE] =>
Apache/2.2.3 (CentOS) Server at https://www.sportslabstores.com.au Port 80

[SERVER_SOFTWARE] => Apache/2.2.3 (CentOS)
[SERVER_NAME] => <https://www.sportslabstores.com.au>
[SERVER_ADDR] => 202.XXX.XXXX.XXXX
[SERVER_PORT] => 80
[REMOTE_ADDR] => 186.XXX.XXXX.XXXX (Proxy IP)
[DOCUMENT_ROOT] => /var/www/sportslab01ADV/htdocs
[SERVER_ADMIN] => [email protected]
[SCRIPT_FILENAME] => /var/www/sportslab01ADV/htdocs/ssltest.php
[REMOTE_PORT] => 20849
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.0
[REQUEST_METHOD] => GET
[QUERY_STRING] => 
[REQUEST_URI] => /ssltest.php
[SCRIPT_NAME] => /ssltest.php
[PHP_SELF] => /ssltest.php
[REQUEST_TIME] => 1312881030

)

SSL is configured at the proxy server.

When did this problem suddenly start?

Hi Dr,

We moved to a dedicated host recently and got a SSL certificate as well for the first time. The site us sitting behind a proxy server which handles traffic(to prevent DDOS). we had tat kind of attack recently.

Can you get your server admin to have the HTTP_X_FORWARDED_BY or HTTP_X_FORWARDED_HOST or HTTP_X_FORWARDED_SSL set, instead of just HTTP_X_FORWARDED_FOR ?

Hi Dr,

Protocol detected: SSL

Array
(
[HTTP_HOST] => https://www.sportslabstores.com.au
[HTTP_X_REAL_IP] => 203.xxx.xxx.xxx
[HTTP_X_FORWARDED_FOR] => 203xxx.xxx.xxx
** [HTTP_X_FORWARDED_SSL] => on
[HTTP_X_FORWARDED_HOST] => https://www.sportslabstores.com.au**
** [HTTP_X_FORWARDED_BY] => 186.xxx.xxx.xxx:443**
[HTTP_CONNECTION] => close
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0
[HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip, deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_COOKIE] => zenid=d9ou11oo1bkpnmko19ib1tkn82; __utma=51135595.1385534463.1312932176.1312932176.1312943093.2; __utmc=51135595; __utmz=51135595.1312932176.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=51135595.2.10.1312943093
[PATH] => /sbin:/usr/sbin:/bin:/usr/bin
[SERVER_SIGNATURE] =>
Apache/2.2.3 (CentOS) Server at https://www.sportslabstores.com.au Port 80

[SERVER_SOFTWARE] => Apache/2.2.3 (CentOS)
[SERVER_NAME] => <https://www.sportslabstores.com.au>
[SERVER_ADDR] => 202.xxx.xxx.xxx
[SERVER_PORT] => 80
[REMOTE_ADDR] => 186.xxx.xxx.xxx
[DOCUMENT_ROOT] => /var/www/sportslab01ADV/htdocs
[SERVER_ADMIN] => [email protected]
[SCRIPT_FILENAME] => /var/www/sportslab01ADV/htdocs/sectest.php
[REMOTE_PORT] => 24009
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.0
[REQUEST_METHOD] => GET
[QUERY_STRING] => 
[REQUEST_URI] => /sectest.php
[SCRIPT_NAME] => /sectest.php
[PHP_SELF] => /sectest.php
[REQUEST_TIME] => 1312946601

)

Great! Glad they were able to help you get it working by tweaking the server's proxy config.

Hi Dr

But still my login page has problems. What I am doing wrong.

https://www.sportslabstores.com.au/index.php?main_page=login

What Zen Cart version?

v 1.3.8a. Unfortunately I cannot update this at the moment.

vivek_advsol:

v 1.3.8a. Unfortunately I cannot update this at the moment.
Take SERIOUS note that you're going to keep hitting big walls on an ongoing basis until you start using current software.

Hi Dr,

Make sense. But I do not have controls on changing over to new version. At least it will take few months.

Is there anything you can help me with this version at the moment.

There are very few files which are safe to copy from v1.3.9 onto an old 1.3.8 site. Fortunately you should be able to copy the /includes/init_includes/init_file_db_names.php file to deal with your site's issue.

Hi Dr,

So you are asking me to change only that file as of now or completely update it. So the problem is with the version!!

Yes, your Zen Cart version is too old to accommodate the server setup you've recently moved to. And the fix they applied is designed for v1.3.9 or newer.

So, yes, a big part of your problem is the very old version of Zen Cart that you're using.

As a VERY TEMPORARY measure, copy and replace the file I mentioned, using the v1.3.9h version of the file to replace your v1.3.8 version of the file. AND MAKE PREPARATIONS TO UPGRADE A.S.A.P.

Thanks Dr. It fix the problem as of now.