When viewing the cart checkout page using https, the credit card images are still loaded using http. This is because the images use absolute paths not beginning with a protocol, e.g. '/sites/default/modules/ubercart/payment/uc_credit/images/visa.gif'. This causes the browser to report that some content on the page is insecure, scaring users away from entering credit card information.
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | uc_credit-ssl_images-1569390-5.patch | 2.29 KB | paulmckibben |
| #2 | uc_credit-ssl_images-1569390-1.patch | 1003 bytes | paulmckibben |
Comments
Comment #1
longwaveAbsolute paths with no protocol should be loaded using the same protocol as the page itself, so if the page is https all paths like this should be loaded over https as well?
Can you link to a site which demonstrates this problem?
Comment #2
paulmckibbenHere is a patch that is working for me. I am using drupal's url() function, with aboslute=true, to ensure the protocol is included in the image URL.
Comment #3
paulmckibbenActually, absolute paths DO NOT use the same protocol. This is a known issue. See http://support.internetconnection.net/THE_WWW/Absolute_and_Relative_File...
The site in question is https://www.babynamewizard.com. Go through the process to purchase a membership and see the checkout page.
Comment #4
paulmckibbenOops, the uc_paypal module has the same problem. I'm working on a new patch that will include a fix for both.
Comment #5
paulmckibbenNew patch attached, addressing both uc_credit and uc_paypal.
Comment #6
longwaveIf we're going to change these at all they should be reworked to use theme('image', ...) instead of hardcoding <img> tags.
Comment #7
longwaveThis change was already made in D7 in #658176-21: Remove inline CSS, let's do the same in 6.x.
http://drupal.org/files/658176-inline-css-payment.patch
Comment #8
longwaveFixed in http://drupalcode.org/project/ubercart.git/commitdiff/e5da756