We have a custom access denied page that uses PHP to output the existing login form. In this case, Secure Pages does not secure the login form.

I'd suggest modifying line 103:
FROM
if (securepages_match('user/login') && $form_id == 'user_login_block' && !$is_https) {
TO
if (securepages_match('user/login') && $form_id == 'user_login_block') {

This resolved the issue for me, and didn't appear to break anything obvious. I didn't want to make this a patch myself because I'm not well versed in all that Secure Pages does, and wasn't sure if this breaks intended operation somewhere I'm not considering.

This is because for whatever reason, my login block on the custom page produces a fully qualified URL for the form action. This means that if I mis-enter the password, the second attempt will be from an SSL page but will submit to a non-SSL page. Another solution would be to check if the action URL is https (rather than the current page), and rewrite if not.

Comments

srees’s picture

srees commented

I additionally noticed that this strips arguments from the form action, when replacing it with a secure URL.

Replacing line 104 with the following handles this:

 parse_str($url['query'],$query);
    $form['#action'] = url($path, array('absolute' => TRUE, 'base_url' => securepages_baseurl(TRUE),'query'=>$query));
srees’s picture

srees commented
Issue summary: View changes

*Edited to remove !$is_https*
This is because for whatever reason, my login block on the custom page produces a fully qualified URL for the form action. This means that if I mis-enter the password, the second attempt will be from an SSL page but will submit to a non-SSL page.

srees’s picture

srees commented
Title: Outputting the login form on a page not at user/login is insecure » Login forms with fully qualified URLs do not remain secured if there is an error

Updating the title to better reflect the real issue.

srees’s picture

srees commented
Issue summary: View changes

Adjust a logic error that was resulting in all forms being secure (thus making anything ajax highly difficult) and explain the root cause of issue.

astonvictor’s picture

astonvictor commented
Issue summary: View changes
Status: Active » Closed (cannot reproduce)

I'm closing it because the issue was created a long time ago without any further steps.

if you still need it then raise a new one.
thanks