Posted by matt@antinomia on January 12, 2007 at 7:55pm
Jump to:
| Project: | e-Commerce |
| Version: | 4.7.x-3.x-dev |
| Component: | authorize_net |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (fixed) |
Issue Summary
When a transaction completes, the authorize.net module redirects users to the "authorize_net_success_url" without SSL. There's no reason this poses a security risk, so far as I can tell, but it sure does generate an error message in IE6 SP2. Attached is a screenshot. Is there any reason this shouldn't be an HTTPS link? Can this even be done with drupal_goto()?
authorize_net.module, line 454:
// We want to go to a http, not https.
//$goto = str_replace('https://', 'http://', $base_url);
drupal_goto(variable_get('authorize_net_success_url', 'node'));
break;| Attachment | Size | Status | Test result | Operations |
|---|---|---|---|---|
| Security-Alert.jpg | 55.67 KB | Ignored: Check issue status. | None | None |
Comments
#1
// We want to go to a http, not https.//$goto = str_replace('https://', 'http://', $base_url);
//drupal_goto(variable_get('authorize_net_success_url', 'node'));
// Or do we?
$goto = str_replace('http://', 'https://', $base_url) . '/' . variable_get('authorize_net_success_url', 'node');
drupal_goto($goto);
break;
Not a formal patch, but this does the trick...
#2
The solution to this problem is to remove all HTTPS-redirection code from authorize_net.module and allow admins to configure SSL pages with the 'securepages' module. I've submitted at least two patches to the module and one of them removes the redirects; you might want to give it a try.
#3
This is now handled by secure pages
#4
#5
(Refering to #1)
Surely it should be:
$goto = str_replace('https://', 'http://', $base_url) . '/' . variable_get('authorize_net_success_url', 'node');#6
I was receiving the exact same Security Alert on a 4.7 site but only in IE6. I installed the Secure Pages module (4.7 dev version) and selected "Switch back to http pages when there are no matches" and showed only on the listed pages:
cart
cart/checkout
cart/review
store
store/*
store/payment/*
authorize_net
authorize_net/*
The real trick here is including the authorize_net path since the redirect to an http:// was what was causing the Security Alert.
I had no need to apply any patches to the authorize_net.module.