Firefox SSL security warning

Glad we are on the same page now, my original question in this thread was asking just that question:

Although this solution does fix the problem, it is a very laborious task for every form within Zen Cart> Maybe someone has found a simple solution to this issue?Glad to hear it is something that will be addressed in a future release. I really don't know if getting the warning would scare off a customer, it was just something I happened to notice and thought it might be worth addressing.

In the meantime I will just go through all the templates manually and modify them so the warning does not happen. They can always be used again in future ZC projects.

Thanks for the discussion.

netbouy, are you working on your site at the moment?

http://bkinky.co.nz/index.php << does not work

Wanted to have a look at your site/problem but will try again later.

Website Rob:

netbouy, are you working on your site at the moment?

http://bkinky.co.nz/index.php << does not work

Wanted to have a look at your site/problem but will try again later.

Hi Website Rob,

Yes, I have been working on the site. It should be going again now.

The problem discussed in this forum has been fixed for the bkinky.co.nz site now though.

netbouy:

It should be going again now.

Ok, spoke to soon...

It appears my webhost has a name server issue they are trying to fix now. I can not access any of it either... sorry about that, it should be back online soon.

Website Rob,

you can see the issue on a number of ZC sites with firefox.

I checked out the first 5 websites from the showcase where there is an https login and a search box on the same page and they all threw the warning...

For example, using Firefox go to the login page on this site from the showcase (should be an https connection). Instead of logging in, try submitting something in the search box... you should get the warning.

Now, if the site is online, try the same thing here ... the warning should not be displayed (hopefully).

With the MomoFresh site I did get an Warning popup but that is due to this:

https://ssl.google-analytics.com/urchin.js

Whenever you hard code an offsite link on an 'https' page, and then go to a non 'https' page, you will always get a Warning msg. One removes the off site link to remove the Warning popup.

I did not get any Warning msg. on your site so it does look like your problem is solved. Speaking of which, guess I missed the warning earlier in this thread, about your site. I don't work with those type sites myself.

hey rob,
yea net recoded all the files to fix it,
but it is a stock issue,

This particular Warning msg. is actually due to the individual Browsers themselves. Some Browsers give an option to 'Warn when loading a page with insecure items' or along those lines. Some Browsers do it automatically.

For example, Mozilla (the original not FF) allows for this:

Under options, 'SSL Warnings',
Viewing a page with an encrypted/unencrypted mix

I could not find an similar type option in FF v1.5.9, so I guess it is built in.

To my knowledge, there is no code one can use to overcome the Warning msg. -- except for making sure you are not mixing secure/insecure links on secure pages.

Yes this is a FF issue,
however there has already been a fix put out,
and net has it in place, No more errors

As an addition to this thread, the "add this to my cart" button brings up this FireFox notification when it is clicked from a secure page.

I've added a few direct links to products from my home page, so after someone logs in, they might click one of these links, view the product on a secure page, click the "add this to my cart" button, and get the warning notice. Not very reassuring...

I've just been looking at a few other ZC sites, and it seems that links to products are always on HTTP, so I guess I should hard-code my custom links to HTTP, right?

That way the customer will always view the product details on a non-secure page. Is that how ZC is designed?

Paul - example of this problem?

Kim:

Paul - example of this problem?

You can see it on almost any ZC site. Go to one of the product description pages - add an 's' to the URL so that you're viewing it on https, then click the "add to cart" button and you will get the warning. Firefox only - no warning in IE.

Although I was able to duplicate what paul3648 was saying, I don't see the problem?

As product pages do not use an SSL connection anyway, as it would slow down the Visitor's Browsing, when would this situation be a problem?

Perhaps I am the only one this will affect, because I've created a box of product links on my home page that link directly to the product description page. I've done this because I want product links above the fold, and I also want the content of my home page.

http://www.teafromtaiwan.com

So I'm guessing that I can simply hard-code my product links to http and that should be OK. Right?

So I'm guessing that I can simply hard-code my product links to http and that should be OK.

Not sure I understand the question? Your site does not use an 'https' connection for the product pages. In fact, I don't see any places other than the usual ones that use an 'https' connection.

As I mentioned above, when a customer follows this sequence at my site, the product description page will be delivered on https:

1. Log in
2. Follow one of my custom links to a product page.

The custom links are coded into the define file for the main page as relative links. So I think I should change them to absolute links to resolve this problem.

I guess I shouldn't even be mentioning this... I guess no-one else will lay out their site in this manner.

I think I can just hard code the links to http, since that seems to be the standard way to reach a product description page.

Right?

How do you get your "Forms Submission" to have a https and not http URL?

I have 2 that seems to be a problem and thus not showing a fully secure:

From FireFox page info:

blablabla/index.php?main_page=advanced_search_result
blablabla/index.php?main_page=account_edit
Thanks

Funny, it is now 2009! and this is STILL BROKEN! Unbelievable that 2 years later I just enabled SSL on Zen and it is driving me crazy as EVERY PAGE that has ssl enabled is popping up this message. It is the dumbest thing I've ever heard of, this whole thread is dumb, JUST FIX THE DAMN BUG and quit saying "ITS NOT A BUG" of course its a BUG if it annoys the hell out of me and my customers and conversely YOUR CUSTOMERS then it is a BUG and needs to be fixed BY YOU so that I am not forced (again 2 YEARS LATER) to have to go through EVERY damn form within YOUR application and do your job for you by modifying the code.

stupid stupid stupid:P
:oops:

Did I say it was a BUG? I meant it is FEATURE THAT SUCKS!

My 2 cents
Thanks, Jarrett Neil Ridlinghafer
Take a look http://www.ironwoodknives.com try adding anything to your cart then going through the checkout process and tell me that is not a bug....if its not fixed by then

netbouy:

Glad we are on the same page now, my original question in this thread was asking just that question:

Glad to hear it is something that will be addressed in a future release. I really don't know if getting the warning would scare off a customer, it was just something I happened to notice and thought it might be worth addressing.

In the meantime I will just go through all the templates manually and modify them so the warning does not happen. They can always be used again in future ZC projects.

Thanks for the discussion.

Hi, Just edit the /includes/config.php file and where it says SSL_Enabled change from 'false' to 'true'

It may not be that exact line but it is like the third section down and you will see, it is where all the SSL and HTTPS sections are found, make sure the https://yourwebsite name is all correct and not commented out also.

I hope that was what you were asking?

--Jarrett

KenMar:

How do you get your "Forms Submission" to have a https and not http URL?

I have 2 that seems to be a problem and thus not showing a fully secure:

From FireFox page info:

blablabla/index.php?main_page=advanced_search_result
blablabla/index.php?main_page=account_edit
Thanks