The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.When securepages is configured to secure user login and ubercart is configured to force user to login before cart checkout, user login triggered by ubercart checkout is insecure. The reason is that both modules rewrite the action of the login form.
I created a patch that securepages modifies the form action after all other modules applied their changes to a form using hook_form_alter. It registers a function to do the modification after form is build using $form['#after_build'].
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | ubercart-420832-3.patch | 2.01 KB | cedarm |
| #1 | securepages.late-action-change.patch | 2.52 KB | mkalkbrenner |
Comments
Comment #1
mkalkbrennerforgot to attach the patch ;-)
Comment #2
gordon commentedThis is an UbërCart issue and not problem with securepages.
UbërCart should not be manipulating URL's of the system.
Comment #3
cedarm commentedUbercart can claim the same, that securepages should not be manipulating URL's of the system. We both change #action, however in uc_cart_form_alter() we blindly overwrite #action. That said, here's a patch to fix Ubercart, but the securepages module weight should also be set heavier to prevent other modules from causing this same issue.
Comment #4
cedarm commentedComment #5
mkalkbrennerComment #6
Island Usurper commentedThanks, Cedar. Patch does the job. For the sake of making sure people's login forms are secure, I'll go ahead and commit your patch.
That said, I still think that securepages should wait to change #action until the #after_build step. It makes it less likely for these kinds of conflicts to happen as the form_alter has already occurred.