Ajeh:
Ask Network Solution why this code cannot detect if their secure pages are secure:
<?php
$request_type = ((isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') ||
(isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == '1') ||
(isset($_SERVER['HTTP_X_FORWARDED_BY']) && strstr(strtoupper($_SERVER['HTTP_X_FORWARDED_BY']),'SSL')) ||
(isset($_SERVER['HTTP_X_FORWARDED_HOST']) && strstr(strtoupper($_SERVER['HTTP_X_FORWARDED_HOST']),'SSL')) ||
(isset($_SERVER['SCRIPT_URI']) && strtolower(substr($_SERVER['SCRIPT_URI'], 0, 6)) == 'https:') ||
(isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443' ) )
? 'SSL' : 'NONSSL';
echo 'I SEE ' . $request_type;
?>
> **superprg:**
>
> Ajeh, can you tell me why do I get images as http when I click on the lock in FireFox and click on media tab..Is that not the problem?
> **Ajeh:**
>
> Because the test that sets the value of is the page secure or not cannot detect it so it says set the:
> ```php
<base href="http://www.poker-dude.com/" />
This means ... that on the secure page the code that is 2000 miles long to do this detection cannot ...
The code Ajeh posted earlier is what Zen Cart does to detect whether a given page is being served in SSL mode or not. If it is, then Zen Cart sets the base-href value to be https instead of http
However, the Network Solutions configuration fails all of those tests.
Specifically:
a) they do not set SERVER[HTTPS] to "on" or "1" -- they leave it blank
b) they strip SERVER[SCRIPT_URI] so that it shows as http://blah instead of https://blah
(SCRIPT_URI typically translates the same as the URL in the browser address bar, unless the webserver is configured to alter it ... which appears to be what netsol is doing)
In comparing phpinfo and all known $_SERVER output from both their HTTP and HTTPS links to the same page, there are no identifiable differences between the two, and thus there appears to be no way to determine concretely that the page is in fact being served as SSL.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
