Loosing secure connection when adding items to cart

dbltoe:

Whether a src for an image, a script, and iframe or simply a source -- a double slash following the src=" violates the whole src attribute syntax and will cause many hours of hair-pulling searches for the problem. The browser would assume it is relative but would be looking for yourSite.com//someFile. Can you say, "Fill the log file?"
The same applies to the new <source> tag in html5.

Thus, the NEVER.

No, it would not look for Your-site dot com//something, it would look for http: // Your-site dot com or https: // Your-site dot com if the information that followed // was Your-site dot com. Ie.

Src="// Chosen-site dot com/foldername/file.jpg

If the current uri were: http :// Mysite dot com/index.php?main_page=product_info&cPath=5&products_id=47

Then the image would be pulled as http :// Chosen-site dot com/foldername/file.jpg

But if the current uri were: https : // Mysite dot com/index.php?min_page=login

Then the image would be pulled as https :// Chosen-site dot com/foldername/file.jpg

Again the http: or https: applicable to the served page would be prepended with the content that includes and follows the //.

My site is working BUT the admin login page doesn't look right nor does the ADMIN page, it's lost all styling.

My error log states the following but (once again) I haven't a clue as to what it means

[26-Aug-2014 09:45:39] PHP Warning: include_once(includes/languages/english.php) [<a href='function.include-once'>function.include-once</a>]: failed to open stream: No such file or directory in .../public_html/bookstore/includes/init_includes/init_templates.php on line 72

[26-Aug-2014 09:45:39] PHP Warning: include_once() [<a href='function.include'>function.include</a>]: Failed opening 'includes/languages/english.php' for inclusion (include_path='.:/usr/lib64/php:/usr/share/pear') in .../public_html/bookstore/includes/init_includes/init_templates.php on line 72

Did I accidentally delete something?

Beth

Yep. Do you have the includes/languages/english.php file? It's saying it can't find it.

mc12345678:

No, it would not look for Your-site dot com//something, it would look for http: // Your-site dot com or https: // Your-site dot com if the information that followed // was Your-site dot com. Ie.

Src="// Chosen-site dot com/foldername/file.jpg

If the current uri were: http :// Mysite dot com/index.php?main_page=product_info&cPath=5&products_id=47

Then the image would be pulled as http :// Chosen-site dot com/foldername/file.jpg

But if the current uri were: https : // Mysite dot com/index.php?min_page=login

Then the image would be pulled as https :// Chosen-site dot com/foldername/file.jpg

Again the http: or https: applicable to the served page would be prepended with the content that includes and follows the //.
Did you notice that EVERY time you mention //, it's with http or htps? Yes, http: or htps: must be followed by // BUT // can never be by itself in a src call.

dbltoe:

Did you notice that EVERY time you mention //, it's with http or htps? Yes, http: or htps: must be followed by // BUT // can never be by itself in a src call.

Again, wrong. Review this web page, then either follow the links to the rfc requirements or independently search for them and you will see that the examples I provided above where src="// servername dot com/filepath/file.extension" will resolve to the same uri with the applicable http: or https: prepended which 1) mitigates the need to hard code one or the other and 2) resolves the issue of mixed (secure/unsecure) content. Html5 is built with the same requirement and will/does work the same way.

Inconsistencies in the config files, which is right or are both correct?

In the admin/includes/config file it states:

<< * WE RECOMMEND THAT YOU USE SSL PROTECTION FOR YOUR ENTIRE ADMIN:

• To do that, make sure you use a "https:" URL for BOTH the HTTP_SERVER and HTTPS_SERVER entries:>>

Then in the includes file it states:

<<// HTTP_SERVER is your Main webserver: eg-http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.yourdomain.com>>

Which is correct? Don't they both have to read the same or are they different?

Ok I changed things to where they match the above statements which are there for a reason, right?

Now my problem is that I have lost the styling of the login page as well as for the ADMIN page, which file controls those?

(I know ya'll designed ZC to thwart the hackers but seriously don't they know more than us poor users?)

motherwestwind:

Ok I changed things to where they match the above statements which are there for a reason, right?

Now my problem is that I have lost the styling of the login page as well as for the ADMIN page, which file controls those?

(I know ya'll designed ZC to thwart the hackers but seriously don't they know more than us poor users?)

There's potentially more than one reason to lose the formatting, one is to validate that you have css template stylesheet files in includes/templates/YOUR_TEMPLATE/css and if not in the YOUR_TEMPLATE directory at least in the template_defaults directory. Also may want to check the error logs again, just to be sure no new ones have appeared.

Well I just gave up on finding WHY I lost the styling of my admin pages and continued adding products, but the problem I am having now is that when I place an order from the category page I loose connection to the database and yet when I order from the individual pages everything is ok. Any idea why those two are different?

I just tried to edit my post but no go, must be my computer.

What I was trying to ask is this: why when I try to add in multiple products from the main page of a category I get an error message stating that we've lost the secure connection to the database while on the individual pages there isn't a problem and everything is ok. What makes these two ordering processes different?

motherwestwind:

I just tried to edit my post but no go, must be my computer.

What I was trying to ask is this: why when I try to add in multiple products from the main page of a category I get an error message stating that we've lost the secure connection to the database while on the individual pages there isn't a problem and everything is ok. What makes these two ordering processes different?
Maybe you have to review your security settings...

aloeycdv:

Maybe you have to review your security settings...

That's why I am here asking for help. Geez what a comment.

I think it's an excellent comment and what we have been trying to get you to do. In a PM, I requested a look at your config files and that was not forthcoming.

We CANNOT see into you .htaccess file in the root NOR can we see either configure.php file. One of those is probably the culprit.

If you will post those (WITHOUT all usernames and passwords - ******* instead) perhaps we can get you going. If you don't want the search engines to see the links, change them to yoursite.com. BUT, we need to see them.

Don't bite the hand that tries to help -- FEED the hand the info needed.

dbltoe:

I think it's an excellent comment and what we have been trying to get you to do. In a PM, I requested a look at your config files and that was not forthcoming.

We CANNOT see into you .htaccess file in the root NOR can we see either configure.php file. One of those is probably the culprit.

If you will post those (WITHOUT all usernames and passwords - ******* instead) perhaps we can get you going. If you don't want the search engines to see the links, change them to yoursite.com. BUT, we need to see them.

Don't bite the hand that tries to help -- FEED the hand the info needed.

Sorry it's been a frustrating time lately even the phone company got into it by cancelling my phone after 16 years, I apologize but it seemed to be a flippant comment.

Here is my .htaccess file:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://mysite.com/$1 [R=301,L]

(I see there is no www. could that be the problem?)

and my includes config file:
// Define the webserver and path parameters
// HTTP_SERVER is your Main webserver: eg-http://www.yourdomain.com
// HTTPS_SERVER is your Secure webserver: eg-https://www.yourdomain.com
define('HTTP_SERVER', 'http://www.mysite.com');
define('HTTPS_SERVER', 'https://www.mysite.com');

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'true');

and the admin includes config file:

WE RECOMMEND THAT YOU USE SSL PROTECTION FOR YOUR ENTIRE ADMIN:

• To do that, make sure you use a "https:" URL for BOTH the HTTP_SERVER and HTTPS_SERVER entries:
  */
  define('HTTP_SERVER', 'https://www.mysite.com');
  define('HTTPS_SERVER', 'https://www.mysite.com');
  define('HTTP_CATALOG_SERVER', 'http://www.mysite.com');
  define('HTTPS_CATALOG_SERVER', 'https://www.mysite.com');

// secure webserver for admin? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_ADMIN', 'true');

// secure webserver for storefront? Valid choices are 'true' or 'false' (including quotes).
define('ENABLE_SSL_CATALOG', 'true')

I just changed the SSL info to read https://www.mysite.com but I still received the error message when I tried to add items into the cart from the catalog page so I tested it. Turns out NOTHING is added into the cart so is this then a template issue and not a security issue?

I am sorry if my frustration at all of this mess lately has spilled out onto you kind people who are here to help, I do apologize.

motherwestwind:

I just changed the SSL info to read https://www.mysite.com but I still received the error message when I tried to add items into the cart from the catalog page so I tested it. Turns out NOTHING is added into the cart so is this then a template issue and not a security issue?

I am sorry if my frustration at all of this mess lately has spilled out onto you kind people who are here to help, I do apologize.

If all works well when using the unmodified ZC default template, but not with the currently installed template, the answer would be yes it's a template related issue. At least related to the files in the template override directories throughout the system.

It is the template ... great ... all that time trusting the designer and here it was the template all along. Thank you for that suggestion, am off to find another that's more reliable.

motherwestwind:

It is the template ... great ... all that time trusting the designer and here it was the template all along. Thank you for that suggestion, am off to find another that's more reliable.

Well, I wouldn't necessarily say that the template needs to be ditched, if you compare the current template's file to the equivalent default template, there may be something missing to work with your version of ZC. Template may have been designed to an earlier version and may not have the latest added "features"... That is if you like the look, but it's not operating quite right...

If it was paid for, well should be able to go back to the individual. If free, well even the best templates offered here on ZC by one of the best template authors has a problem here and there, but that is usually covered in the forum applicable to the template. Anyways, just saying that there is always a possibility of a problem/mistake, but should be something easily worked through generally speaking. There are some template sources not on this site that are known to have issues and tend not to work fully with ZC contrary to the advertising.

Glad you figured it out though.

mc12345678:

Well, I wouldn't necessarily say that the template needs to be ditched, if you compare the current template's file to the equivalent default template, there may be something missing to work with your version of ZC. Template may have been designed to an earlier version and may not have the latest added "features"... That is if you like the look, but it's not operating quite right...

Good thought, thank you I will do that. I think the main difficulty has been my jumping into the world of responsive design without understanding the complexity of the programming involved that had to uninstalled rather than just deleted. I am used to 1.39 where you could switch back and forth between templates with ease. There may still be something lurking from quitting the responsive design template and trying to get back to legacy. I'll start over with this template in a different folder and see if that was the issue, otherwise it might be a corrupted patch to the database. Meanwhile I'm working with a familiar template which served me well. My fault for trying to get fancied up.

Are you losing the secure connection or are you getting a mixed content warning?

I was getting a mixed content warning and found a hardcoded link to

<script src="http://cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.3/jquery.easing.min.js" type="text/javascript"></script>

which was fixed with a suggestion from mc12345678 to just remove the http: reference

<script src="//cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.3/jquery.easing.min.js" type="text/javascript"></script>

Could your issue could be something similar?