Firefox SSL security warning

Let us know what you discover ... :smile:

Please help if you can.

Chrome, Firefox, and Safari work fine, but when a customer logs into MyAccount with Internet Explorer the HTTPS error comes up and tells them it is not secure. It has to do with the blank sidebox linking to an outside site.

Can someone please point me in the right direction? TY!

Cindy

http://store.burrellcolourimaging.com/

I think I got it... just made the image SSL and it seems to be working. Thanks anyway! :)

I've added the following code to html_output.php in 'function zen_href_link' to fix the security warning issue with firefox etc. Just thought I would post it here for anyone else. Feedback/criticism/suggestions greatly appreciated!

function zen_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true, $search_engine_safe = true, $static = false, $use_dir_ws_catalog = true) {
    global $request_type, $session_started, $http_domain, $https_domain;

if($connection=='NONSSL' && $request_type=='SSL')
{
			
	if( $page == FILENAME_ADVANCED_SEARCH_RESULT
	|| $page == FILENAME_ADVANCED_SEARCH
	|| $page == FILENAME_DEFAULT
	|| $page == FILENAME_SHOPPING_CART)
	{
		$connection = $request_type;
	}
}

..rest of function is unchanged...

-Fold

fold:

I've added the following code to html_output.php in 'function zen_href_link' to fix the security warning issue with firefox etc. Just thought I would post it here for anyone else. Feedback/criticism/suggestions greatly appreciated!

function zen_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true, $search_engine_safe = true, $static = false, $use_dir_ws_catalog = true) {
global $request_type, $session_started, $http_domain, $https_domain;

if($connection=='NONSSL' && $request_type=='SSL')
{

if( $page == FILENAME_ADVANCED_SEARCH_RESULT
|| $page == FILENAME_ADVANCED_SEARCH
|| $page == FILENAME_DEFAULT
|| $page == FILENAME_SHOPPING_CART)
{
	$connection = $request_type;
}

}

..rest of function is unchanged...

> 
> -Fold

Although it seems to keep more pages secure than necessary, it seems to work for me.  I prefer this over a faster site potentially perceived as insecure.  Even if this code slows site performance I still think this is better.  Thanks :clap:

Sorry but would you be able to explain a little more clearly what text needs to be replaced?

At the minute in my: admin/includes/functions/html_output.php file for the text you have mentioned above I have:

// The HTML href link wrapper function
  function zen_href_link($page = '', $parameters = '', $connection = 'NONSSL', $add_session_id = true) {
    global $request_type, $session_started, $http_domain, $https_domain;
    if ($page == '') {
      die('</td></tr></table></td></tr></table><br><br><font color="#ff0000"><b>Error!</b></font><br><br><b>Unable to determine the page link!<br><br>Function used:<br><br>zen_href_link(\'' . $page . '\', \'' . $parameters . '\', \'' . $connection . '\')</b>');
    }

    if ($connection == 'NONSSL') {
      $link = HTTP_SERVER . DIR_WS_ADMIN;
    } elseif ($connection == 'SSL') {
      if (ENABLE_SSL_ADMIN == 'true') {
        $link = HTTPS_SERVER . DIR_WS_HTTPS_ADMIN;
      } else {
        $link = HTTP_SERVER . DIR_WS_ADMIN;
      }
    } else {
      die('</td></tr></table></td></tr></table><br><br><font color="#ff0000"><b>Error!</b></font><br><br><b>Unable to determine connection method on a link!<br><br>Known methods: NONSSL SSL<br><br>Function used:<br><br>zen_href_link(\'' . $page . '\', \'' . $parameters . '\', \'' . $connection . '\')</b>');
    }
    if (!strstr($page, '.php')) $page .= '.php';
    if ($parameters == '') {
      $link = $link . $page;
      $separator = '?';
    } else {
      $link = $link . $page . '?' . $parameters;
      $separator = '&';
    }

    while ( (substr($link, -1) == '&') || (substr($link, -1) == '?') ) $link = substr($link, 0, -1);

Where do I need to put the code that you mentioned in the above post?

Thanks in advance.

Graham.

Hi

I have tried the fixes mentioned in this thread but am still getting the warning on Product Info Pages but not on All Products listing.

When I first looked at the site this morning, I could not get the Create an Account page - it said Session had expired .... but about the third tome of trying it, it worked (without having made any changes.)

I have recently changed hosts and changed to SSL.

In IE, I am getting an empty cart when I add to cart. In Firefox I am getting a warning. I can add to cart from product listing pages but not from product info pages.

Please please please ... can anyone help me?

Thanks

Gillian
qualitygardenfurniture.com/store

Ajeh:

This is the change for the tpl_products_info_default.php ... you will need to take it from there or you can contact me privately for further di$cu$$ion$ on cu$tomizing your $ite ... :cool:

This was annoying me for most of the day, your post provided a solution. It apparently only happens if a visitor views a product, then logs in. It is returning to that product and adding to cart which generated the firefox warning. Thanks for the tip!

Ajeh:

This is the change for the tpl_product_info_display.php ... you will need to take it from there or you can contact me privately for further di$cu$$ion$ on cu$tomizing your $ite ... :cool:

Sorry wrong post

Ajeh:

This is the change for the tpl_product_info_display.php ... you will need to take it from there or you can contact me privately for further di$cu$$ion$ on cu$tomizing your $ite ... :cool:

Ajeh, 
I have the same problem but cannot find the tpl_products_info_default.php to apply your fix. I'm using v1.3.8
Please help. Thanx

Sorry, hate when I do that ... the filename is:
tpl_product_info_display.php

In IE and chrome im also getting this unsecure message. I have change all the thing what has been saying here some fix's where already there im using 1.3.9a

The side effect what i get in IE is the page is all messed up. When i click yes to go furder. But the main page look good.

in de source i still see the normale http urls for the search buttons from the top and the sidebox. But the tpl_search_header is changed with the $request_type.

The file tpl_product_info_display
I have tryed like this:

<?php echo zen_draw_form('cart_quantity', zen_href_link(zen_get_info_page($_GET['products_id']), zen_get_all_get_params(array('action')) . 'action=add_product', $request_type), 'post', 'enctype="multipart/form-data"') . "\n"; ?>

and like this:

<?php echo zen_draw_form('cart_quantity', zen_href_link(FILENAME_SHOPPING_CART, 'action=update_product', $request_type)); ?>

But then again still dont see the error to be gone :cry:

Any idee and help would be very nice
Thanks in advance

TALES

In the html_output file i have change now this:

if ($connection == 'NONSSL') {
      $link = HTTP_SERVER;
    } elseif ($connection == 'SSL') {
      if (ENABLE_SSL == 'true') {
        $link = HTTPS_SERVER ;
      } else {
        $link = HTTP_SERVER;
      }

to this:

if ($connection == 'NONSSL') {
      $link = HTTPS_SERVER;
    } elseif ($connection == 'SSL') {
      if (ENABLE_SSL == 'true') {
        $link = HTTPS_SERVER ;
      } else {
        $link = HTTP_SERVER;
      }

Now the whole site is SSL on every link that i see. But still getting the error like: This site contain diffrent sources that are not secure. These source can be seen by others. etc..

How this can be if everything has an HTTPS now?

Put the code back how it was and if you could perhaps let us see an URL to this issue we could tell you how to fix it correctly ... :smile:

I found it ...

<!--bof Form start-->
<?php echo zen_draw_form('cart_quantity', zen_href_link(zen_get_info_page($_GET['products_id']), zen_get_all_get_params(array('action')) . 'action=add_product', $request_type), 'post', 'enctype="multipart/form-data"') . "\n"; ?>
<!--eof Form start-->

That fixes it on the template for the product _info ...

You will need to fix the other product types too if you use them ...

Ok finaly i have change back all the files and i changed only what you just say in your last post.

What i get is when i want to login then im getting the message from IE.

I set the confige file back to true SSL

the url to my website is https://www.apajo.nl
hope you can help me furder.

Greets
TALES

OK I think I have hit upon a simple brute force solution to all this rubbish that has been driving everyone nuts for years, myself included.

I have taken a complete directory contaning a 1.39 install and done a bulk find and replace of every instance of 'NONSSL' with '$request_type' (yes I know that this bull in china shop move lacks elegance - but hey warning folk not to buy stuff is really offensive IMHO).

Then a bulk find and replace of every instance of ), 'post',
with , $request_type), 'post',

Then a bulk find and replace of every instance of
$request_type, $request_type), 'post', with $request_type), 'post',

Closed all browser sessions on the site and tested it.

SO FAR nothing has broken, and on the contrary I have a completely functional site moving from HTTPS to HTTP and back again via numerous sequences of forms including searching, adding products from search results, and back tracking from checkout to add extra items etc without any weirdness or error messages whatsoever.

I would be very grateful if anyone can discover a problem with this or confirm that this is in fact the industrial fix that it appears to be. Added to which I am sure it is worth coming up with a more refined NONSSL replacement term that just bulldozing the lot.

FYI I used the source code search in Dreamweaver across a folder to achieve this - probably many other editors can do the same job.

Hope it helps. (Oh and don't blame me if you did not back up everything first).

:oops: DON'T

global replacement of NONSSL is too rude, it screws the Admin (and it seems unnecessary anyway).

:clap:

Just this function directed at the includes directory seems to be all that is required and appears to be perfect:

Then a bulk find and replace of every instance of ), 'post',
with , $request_type), 'post',

Then a bulk find and replace of every instance of
$request_type, $request_type), 'post', with $request_type), 'post',