Closed (outdated)
Project:
Secure Pages
Version:
6.x-1.8
Component:
Code
Priority:
Critical
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
14 Oct 2009 at 21:16 UTC
Updated:
26 Nov 2024 at 09:09 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
jim kirkpatrick commentedConfirmed... and marking as critical since any module that needs a query string passed between http and https pages is broken by this bug. See this includes Organic Groups as per #705788: Create page/Create story from og page throws "Passed variable not array" warning.
Essentially, the Secure Pages module is mashing the querystring by escaping when it shouldn't across the change in security context.
Had to disable Secure Pages on node add/edit pages to allow OG to work for group members posting content.
Comment #2
Anonymous (not verified) commentedInteresting , i'll take a look at this tomorrow Jim
Comment #3
kjantin commentedI am experiencing the same problem. I have enabled Secure Pages 6.x-1.8 and had initially set the following pages to be secure:
node/add/*
node/*/edit
When users went to add content to a group (via organic groups) the links would break and the content would not be related to the group it was meant to be created in.
In the related issue http://drupal.org/node/705788, pgillis suggests "You set the security level the same on both sides of the link. Meaning the view page is secure along with the add page or neither of them are secure." Has anyone else implemented this on their site? I would assume I would need to secure every group (group/*) and every type of content (blog/* wiki/* etc) and also every view for each content (group/*/blogs).
I haven't tried that yet (the problem with playing with the Secure Pages module is that it's all on your live site!) - I'm hoping that someone might be working on a solution to this.
Thanks,
Kristin
Comment #4
jcarnett commentedA patch is attached to fix the query string handling in 6.x-1.8. It looks like a fix was committed to CVS as well, but I really don't trust that one either.
Comment #5
astonvictor commentedI'm closing it because the issue was created a long time ago without any further steps.
if you still need it then raise a new one.
thanks