Zen Cart Logo
Forums / General Questions / Security Warnings from browsers

Security Warnings from browsers

Locked

Views: 4,253

Results 1 to 10 of 10
This thread is locked. New replies are disabled.
15 Nov 2006, 12:07 AM
#1
pfabrick avatar

pfabrick

New Zenner

Join Date:
Jan 2006
Posts:
66
Plugin Contributions:
0

Security Warnings from browsers

I have a wholesale site that is for approved retail customers only and they have to log in to view the prices. I'm having problems with browsers displaying error messages...

In Firefox, the problem I'm having is when they login, they're still on the https (secure) - so when they click on a manufacturer or submit a search, they get a popup security warning from their browser stating that "although this page is encrypted, the information is being sent over an unencrypted connection". This error does not occur when clicking on anything else - directly on a product, on the shopping cart, one of the information links, or a category.

In IE7, I get a little nicer warning at the top of the page stating that for security purposes, IE has blocked display of images that are not secure. This includes my heading images for my boxes.

Any ideas on what I could do to avoid these errors? Unfortunately, these type of warnings really scare customers. I'd be happy to provide account info to anyone who want to see these errors in action.

Thanks for your help!
Patti

15 Nov 2006, 12:08 AM
#2
ajeh avatar

ajeh

Oba-san

Join Date:
Sep 2003
Location:
Ohio
Posts:
62,757
Plugin Contributions:
1

Re: Security Warnings from browsers

Any submit that is going from secure to non-secure will throw a warning ...

You could set your side boxes to have the submits when the page is non-secure ... and a link to non-secure page when the secure is active to prevent this ...

15 Nov 2006, 8:50 AM
#3
pfabrick avatar

pfabrick

New Zenner

Join Date:
Jan 2006
Posts:
66
Plugin Contributions:
0

Re: Security Warnings from browsers

Oooh, Ajeh...you got some wheels turning now. Thanks for the kick-start! I'll do some fiddling around and let you know what I come up with.

Patti

15 Nov 2006, 7:04 PM
#4
pfabrick avatar

pfabrick

New Zenner

Join Date:
Jan 2006
Posts:
66
Plugin Contributions:
0

Re: Security Warnings from browsers

OK, here's what I came up with...I surrounded the form tag and the submit button with an if statement to determine if we're in https....the form tag has to be included due to the enter key automatically submitting the form. I used JS because we needed to get the value from the text box to dynamically define the link. Here's the code from tpl_search.php...

 $content = "";
  $content .= '<div id="' . str_replace('_', '-', $box_id . 'Content') . '" class="sideBoxContent centeredContent">';
  if ($_SERVER["HTTPS"]) {//yes, this is a secure page
	  $content .= zen_draw_form('quick_find', 'JavaScript:window.location="http://www.mywebsite.com/index.php?main_page=advanced_search_result&search_in_description=1&keyword=" + document.quick_find.keyword.value', 'get');
  }else{
	  $content .= zen_draw_form('quick_find', zen_href_link(FILENAME_ADVANCED_SEARCH_RESULT, '', 'NONSSL', false), 'get');
  }
  $content .= zen_draw_hidden_field('main_page',FILENAME_ADVANCED_SEARCH_RESULT);
  $content .= zen_draw_hidden_field('search_in_description', '1') . zen_hide_session_id();

  if (strtolower(IMAGE_USE_CSS_BUTTONS) == 'yes') {
    $content .= zen_draw_input_field('keyword', '', 'size="18" maxlength="100" style="width: ' . ($column_width-30) . 'px"') . '<br />';
    if ($_SERVER["HTTPS"]) {//yes, this is a secure page
		$content .= '<a href=\'JavaScript:window.location="http://www.mywebsite.com/index.php?main_page=advanced_search_result&search_in_description=1&keyword=" + document.quick_find.keyword.value\' name="searchLink">Search</a>';
	}else{
		$content .= zen_image_submit (BUTTON_IMAGE_SEARCH,HEADER_SEARCH_BUTTON);
	}
    $content .= '<br /><a href="' . zen_href_link(FILENAME_ADVANCED_SEARCH) . '">' . BOX_SEARCH_ADVANCED_SEARCH . '</a>';
  } else {
  	$content .= zen_draw_input_field('keyword', '', 'size="18" maxlength="100" style="width: ' . ($column_width-30) . 'px" value="' . HEADER_SEARCH_DEFAULT_TEXT . '" onfocus="if (this.value == \'' . HEADER_SEARCH_DEFAULT_TEXT . '\') this.value = \'\';" onblur="if (this.value == \'\') this.value = \'' . HEADER_SEARCH_DEFAULT_TEXT . '\';"') . '<br />';
  	if ($_SERVER["HTTPS"]) {//yes, this is a secure page
		$content .= '<a href=\'JavaScript:window.location="http://www.mywebsite.com/index.php?main_page=advanced_search_result&search_in_description=1&keyword=" + document.quick_find.keyword.value\' name="searchLink">Search</a>';
	}else{
		$content .= '<input type="submit" value="' . HEADER_SEARCH_BUTTON . '" style="width: 50px" />';
	}
    $content .= '<br /><a href="' . zen_href_link(FILENAME_ADVANCED_SEARCH) . '">' . BOX_SEARCH_ADVANCED_SEARCH . '</a>';
  }

  $content .= "</form>";
  $content .= '</div>';

I'm sure this could be cleaner but I've found that it's easier for future upgrades this way. Of course, this is in my template override directory! It works like a charm unless JS is disabled - checked in FF1.5, IE7 and Opera9. I'll add a button image in the link to make it look prettier.

Any ideas on how to check if JS is disabled, so we could display the original elements (even though they'd get a security warning)? In my test case, which was writing the html code directly, I used <noscript> tags to write out the original elements, then checked for the existence of that element before writing the JS version. It works great...but I don't think that'll work with the search sidebox template due to the way it's developed as a string.

Next is the manufacturer's sidebox!!

Patti

15 Nov 2006, 7:29 PM
#5
pfabrick avatar

pfabrick

New Zenner

Join Date:
Jan 2006
Posts:
66
Plugin Contributions:
0

Re: Security Warnings from browsers

OK, the manufacturers sidebox was super-easy! Here are the changes to the tpl_manufacturers_select.php file (again - saved in my template override directory):

$content.= zen_draw_form('manufacturers', 'JavaScript:window.location="http://www.mywebsite.com/index.php?main_page=index&manufacturers_id="+document.manufacturers.manufacturers_id.value', 'get');

Just that one line change and it works like a charm! Same issue with the JS being disabled although this sidebox already had that issue due to the onchange event calling this.form.submit().

28 Jan 2007, 6:03 AM
#6
stagebrace avatar

stagebrace

Totally Zenned

Join Date:
Jan 2005
Location:
Tennessee
Posts:
985
Plugin Contributions:
0

Re: Security Warnings from browsers

I have tested a second solution. I changed the variable "NONSSL" to "SSL" for the files related to search. The resulting search page shows up as secure but at least there is no warning box displayed to the customer.

28 Jan 2007, 6:10 AM
#7
ajeh avatar

ajeh

Oba-san

Join Date:
Sep 2003
Location:
Ohio
Posts:
62,757
Plugin Contributions:
1

Re: Security Warnings from browsers

Don't do that ...

Forcing secure all of the time is not a good idea ...

To fix this, you need to change 20+ files ...

Somewhere is a thread explaining it that I just made ...

28 Jan 2007, 6:37 AM
#9
stagebrace avatar

stagebrace

Totally Zenned

Join Date:
Jan 2005
Location:
Tennessee
Posts:
985
Plugin Contributions:
0

Re: Security Warnings from browsers

Thank you.
I changed it to $request_type. With my super simple template /setup I only need to change one file.

28 Jan 2007, 6:39 AM
#10
ajeh avatar

ajeh

Oba-san

Join Date:
Sep 2003
Location:
Ohio
Posts:
62,757
Plugin Contributions:
1

Re: Security Warnings from browsers

umm ... really play with the navigation ... you'd be amazed the patterns one can follow to produce the warning ... :eek: