Closed (duplicate)
Project:
reCAPTCHA
Version:
6.x-1.x-dev
Component:
General
Priority:
Critical
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
19 Apr 2011 at 19:20 UTC
Updated:
2 May 2011 at 18:29 UTC
The path to load recaptcha_ajax.js is hard-coded as:
drupal_set_html_head('<script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>');
(recaptcha.module line 154)
This causes a security warning in Chrome browsers. Not sure why only Chrome complains about this, no other browser seems to. This is a critical issue because it can cost sales when customers are not able to trust the security of a site's credit card processing because of browser security warnings.
Solution: change recaptcha_ajax.js script source to
https://www.google.com/recaptcha/api/js/recaptcha_ajax.js
...or possibly switch between http:// and https:// based on $_SERVER['HTTPS']).
Comments
Comment #1
mvcno need to test; simpler for this to always be HTTPS
fixed in #1124950: reCAPTCHA uses a new HTTPS API URL