SSL How to find non-secure items on a page ?

Discussion regarding Joomla! security issues.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
User avatar
ausnets
Joomla! Intern
Joomla! Intern
Posts: 59
Joined: Fri Jun 29, 2007 12:28 am
Location: Queensland, Australia
Contact:

SSL How to find non-secure items on a page ?

Post by ausnets » Fri Nov 30, 2007 11:06 pm

Have added an SSL cert. to a client's site: Joomla 1.1.13, and virtuemart.

Have fixed most issues thanks to the forum, I've secured the whole site under the SSL by using a redirect in the .htaccess file.

But now this issue remains:

In Firefox, no problems, but in IE, still getting the 'This page contains both secure and nonsecure items' warning pop-up.

My question is how can I tell which items are nonsecure ? Even if I say 'no' to displaying nonsecure items, all the images appear ok, in fact I can't see anything missing, no 'red cross' image holders etc.

www.nmbs.com.au

Thanks so much.

User avatar
musiczineguy
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 200
Joined: Sat Nov 11, 2006 5:01 am
Location: East Greenbush, NY
Contact:

Re: SSL How to find non-secure items on a page ?

Post by musiczineguy » Fri Nov 30, 2007 11:39 pm

Your SSL cert is protecting anything in your domain, nmbs.com.au and its subdirectories.

The four links at the bottom of the page are causing the message.  All four are pointing to non-ssl http pages, not in the domain protected by your SSL cert, thus the warning.

A quick google of the problem comes up with a lot of suggestions.. the most common one being to point your links to secure pages, but you can't necessarily pick and choose the type of pages you're linking to, so that might not help you.

The other thing, for images, was to just use a virtual link  like /images/image.gif  instead of http://www.mysite.com/images/image.gif

You might try stripping the http:// from the link and just trying it with the URI...

User avatar
ausnets
Joomla! Intern
Joomla! Intern
Posts: 59
Joined: Fri Jun 29, 2007 12:28 am
Location: Queensland, Australia
Contact:

Re: SSL How to find non-secure items on a page ?

Post by ausnets » Sat Dec 01, 2007 12:04 am

Thanks for the reply, I really appreciate it.

I just removed those 4 links from the front page and the same problem exists.

Is it just a question of going through page by page until I find an explicit link to http://something  ?

Thanks !

User avatar
musiczineguy
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 200
Joined: Sat Nov 11, 2006 5:01 am
Location: East Greenbush, NY
Contact:

Re: SSL How to find non-secure items on a page ?

Post by musiczineguy » Sat Dec 01, 2007 3:10 am

ausnets wrote: Is it just a question of going through page by page until I find an explicit link to http://something  ?

That was actually a recommendation I saw on one of the pages I looked at.  Based on the information I read, your problem lies in the page trying to access something or link to something that is http:// rather than https://

I wish I could be of more assistance to you, unfortunately SSL is not my strong suit.

User avatar
dianascherff
Joomla! Fledgling
Joomla! Fledgling
Posts: 3
Joined: Tue Nov 07, 2006 9:27 am
Location: Los Angeles, CA, USA

Re: SSL How to find non-secure items on a page ?

Post by dianascherff » Fri Dec 07, 2007 1:00 am

I'm having the same problem.  I switched over to SSL last night and after tons of work I'm still having problems.  I started by using relative links and "image.gif", I even removed 3rd party scripts from my site and I still got the mixed content error.  I then changed all links to https://... and the same with images, but still nothing.  It's best for me to use the full URL because parts of my site need to be secure and other parts don't, so when someone clicks on a specific link, I need it to send them to the secure site.  I may end up just putting a small note on the site telling users how to turn off that error.  I can stand it but I'm sure users will run screaming  :'(
***** Manual signatures are NOT allowed ********** Manual signatures are NOT allowed *****
dianascherff.com
sutherland-scherff.net

Lain14
Joomla! Apprentice
Joomla! Apprentice
Posts: 15
Joined: Fri Sep 22, 2006 3:13 am

Re: SSL How to find non-secure items on a page ?

Post by Lain14 » Fri Dec 14, 2007 1:30 am

If you use Google analytics code on your index.php of your template file this is the problem. I had the same problem, spent days looking for the issue only to remove the Google script and the problem when away. There is a new mambot that allows you to add the Google code so that it switches to secure when needed.

User avatar
whiteboxlabs
Joomla! Intern
Joomla! Intern
Posts: 63
Joined: Wed Aug 24, 2005 7:31 pm
Contact:

Re: SSL How to find non-secure items on a page ?

Post by whiteboxlabs » Tue Dec 18, 2007 7:57 pm

having same issue.  Not using Google Analytics at all.

User avatar
hobartimus
Joomla! Intern
Joomla! Intern
Posts: 58
Joined: Thu Jul 20, 2006 1:58 pm
Location: Texas
Contact:

Re: SSL How to find non-secure items on a page ?

Post by hobartimus » Thu Dec 20, 2007 3:52 am

Interesting. I have built more than a dozen Joomla/VirtueMart sites and not had any serious problem with the secure/nonsecure warning.

However, I just launched my first site using 1.0.13 and I get the warning on every secure page. I have checked all the regular culprits and cannot find a problem. Also, on secure page I get a syntax error on line 2.

All of this happens only in IE, of course.
Best Regards,
Howard Theriot
http://www.catchlight.com

greenkoi
Joomla! Apprentice
Joomla! Apprentice
Posts: 21
Joined: Sun Jun 17, 2007 4:28 am

Re: SSL How to find non-secure items on a page ?

Post by greenkoi » Wed Mar 19, 2008 6:20 pm

Have you found any resolution to this ?

IE7 is saying page not found when clicking on the OK to display secure and nonsecure items. IE6 throws the warning as well, but

FF and Safari work fine. . . .

http://www.fairtradeteas.com

User avatar
ausnets
Joomla! Intern
Joomla! Intern
Posts: 59
Joined: Fri Jun 29, 2007 12:28 am
Location: Queensland, Australia
Contact:

Re: SSL How to find non-secure items on a page ?

Post by ausnets » Wed Mar 19, 2008 10:09 pm

I wish there was a resolution to this.

We have simply started to tell all potential customers we will not build Secure Joomla/Virtuemart sites.
They have to accept PayPal.

Not ideal, but what can we do ?

greenkoi
Joomla! Apprentice
Joomla! Apprentice
Posts: 21
Joined: Sun Jun 17, 2007 4:28 am

Re: SSL How to find non-secure items on a page ?

Post by greenkoi » Thu Mar 20, 2008 3:08 am

On the site, we only use PayPal and Google Checkout . . .

So I'm already half way there.

I've turned off every module and have stripped the site down in testing to see if there was something third-party, in terms of CSS or JS that might have been causing it, but still no luck.

I ran through the order process and I do see some VM code where there are HTTP vs HTTPS links on this page:

https://www.fairtradeteas.com/index.php ... &Itemid=29

A section of code that looks like it'd be updating the quantity / remove items from cart has what I think may be the offending code:

Code: Select all

    <td>
		<form action="https://www.fairtradeteas.com/index.php" method="post">
		<input type="hidden" name="option" value="com_virtuemart" />
		<input type="text" title="Update Quantity In Cart" class="inputbox" size="4" maxlength="4" name="quantity" value="1" />	</td>
    <td>$27.82</td>
    <td><input type="hidden" name="page" value="checkout.index" />
        <input type="hidden" name="func" value="cartUpdate" />
        <input type="hidden" name="product_id" value="21" />
        <input type="hidden" name="Itemid" value="29" />
        <input type="hidden" name="description" value="" />
        <input type="image" name="update" title="Update Quantity In Cart" src="http://www.fairtradeteas.com/components/com_virtuemart/shop_image/ps_image/edit_f2.gif" border="0"  alt="Update" />
      </form></td>
    <td><form action="https://www.fairtradeteas.com/index.php" method="post" name="delete" >
        <input type="hidden" name="option" value="com_virtuemart" />
        <input type="hidden" name="page" value="checkout.index" />
        <input type="hidden" name="Itemid" value="29" />
        <input type="hidden" name="func" value="cartDelete" />
        <input type="hidden" name="product_id" value="21" />
        <input type="hidden" name="description" value="" />
      <input type="image" name="delete" title="Delete Product From Cart" src="http://www.fairtradeteas.com/components/com_virtuemart/shop_image/ps_image/delete_f2.gif" border="0" alt="Delete Product From Cart" />
      </form></td>
Could this be the code causing it do throw warnings in IE ?

User avatar
keliix06
Joomla! Ace
Joomla! Ace
Posts: 1022
Joined: Wed Aug 17, 2005 11:46 pm
Location: Minneapolis, MN
Contact:

Re: SSL How to find non-secure items on a page ?

Post by keliix06 » Thu Mar 20, 2008 6:46 am

Links have nothing to do with giving this error. It's only things that try to load on the page itself, i.e. when you see src="...

On https://www.fairtradeteas.com/index.php ... &Itemid=29 ALL of the Virtuemart images load as non-secure.

From the code you posted
src="http://
is exactly what will give this error. I haven't tested the newest VM versions, and you may want to check at their forums, but it only used to load images as secure through the checkout process, and only if the ssl redirect was enabled in the VM config.
Doyle Lewis
BuyHTTP Internet Services
http://www.buyhttp.com/joomla_hosting.html - No Overselling Guarantee. Your Joomla site, faster.
http://www.joomlademo.com - 30 day free trial of Joomla

greenkoi
Joomla! Apprentice
Joomla! Apprentice
Posts: 21
Joined: Sun Jun 17, 2007 4:28 am

Re: SSL How to find non-secure items on a page ?

Post by greenkoi » Fri Mar 21, 2008 7:37 pm

This may not be the most elegant solution in getting VM to play nice with IE, but it got me over the hump.

The Update Cart / Empty Cart images which were being called over HTTP vs. HTTPS, but I was having trouble figuring out how to best remedy it. So I searched the VM files to see where those images were being called and I found:

html/basket.php
html/ro_basket.php

Which I found by doing a search for the image names: edit_f2.gif and delete_f2.gif

Around line 138 in basket.php replace IMAGEURL

Code: Select all

        <input type=\"image\" name=\"update\" title=\"". $VM_LANG->_PHPSHOP_CART_UPDATE ."\" src=\"". IMAGEURL ."ps_image/edit_f2.gif\" border=\"0\"  alt=\"". $VM_LANG->_PHPSHOP_UPDATE ."\" />
with the full path to the files:

Code: Select all

 <input type=\"image\" name=\"update\" title=\"". $VM_LANG->_PHPSHOP_CART_UPDATE ."\" src=\"". "https://www.fairtradeteas.com/components/com_virtuemart/shop_image/ps_image/edit_f2.gif\" border=\"0\"  alt=\"". $VM_LANG->_PHPSHOP_UPDATE ."\" />
And again at line 147:

Code: Select all

  <input type=\"image\" name=\"delete\" title=\"". $VM_LANG->_PHPSHOP_CART_DELETE ."\" src=\"". IMAGEURL ."ps_image/delete_f2.gif\" border=\"0\" alt=\"". $VM_LANG->_PHPSHOP_CART_DELETE ."\" />
with the full path:

Code: Select all

<input type=\"image\" name=\"delete\" title=\"". $VM_LANG->_PHPSHOP_CART_DELETE ."\" src=\""."https://www.fairtradeteas.com/components/com_virtuemart/shop_image/ps_image/delete_f2.gif\" border=\"0\" alt=\"". $VM_LANG->_PHPSHOP_CART_DELETE ."\" />
It may not be the most elegant solution, but it got me over the IE unsecured items issue.

I realize I may be posting this in the incorrect area, but wanted to get my solution out there as I know from reading other posts it was giving folks a real hard time.

deafbiz
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 117
Joined: Sun Aug 28, 2005 3:09 am

Re: SSL How to find non-secure items on a page ?

Post by deafbiz » Wed May 21, 2008 5:29 pm

Not to derail the thread, but my situation is similar to yours. The current installation of J 1.0.15 and VM 1.10 created a new set of non-secure ie6/ie7 items.

Here's the post:
http://forum.virtuemart.net/index.php?topic=40552.0

I identify the culprit is this part in virtuemart.cfg.php:
Quote
<div class="quote">define( 'URL', $mosConfig_live_site.$app );
define( 'SECUREURL', 'https://www.domain.com/' );

if ( @$_SERVER'HTTPS' == 'on' ) {
define( 'IMAGEURL', SECUREURL .'components/com_virtuemart/shop_image/' );
} else {
define( 'IMAGEURL', URL .'components/com_virtuemart/shop_image/' );
}
define( 'VM_THEMEPATH', $mosConfig_absolute_path.'/components/com_virtuemart/themes/default/' );
define( 'VM_THEMEURL', $mosConfig_live_site.'/components/com_virtuemart/themes/default/' );
</div>/QUOTE

/components/com_virtuemart/themes/default/ DOES NOT turn to HTTPS !!!

/components/com_virtuemart/themes/default/ was NOT in VM 1.0.5 so that's why I didn't have the problem as I do now.

How can I make this folder https or make the unsecure warning go away?

Thank you.

User avatar
subrat
Joomla! Ace
Joomla! Ace
Posts: 1038
Joined: Sat Jul 08, 2006 7:36 am
Location: India
Contact:

Re: SSL How to find non-secure items on a page ?

Post by subrat » Sat May 31, 2008 5:26 am

Had a similar issue, dont know whether its the same but you could check out this thread..

http://forum.virtuemart.net/index.php?topic=36696.15

regards
Quality WebDevelopment at http://www.webworkwiz.com
Affordable hosting http://www.vsmhosting.com

deafbiz
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 117
Joined: Sun Aug 28, 2005 3:09 am

Re: SSL How to find non-secure items on a page ?

Post by deafbiz » Sat May 31, 2008 5:06 pm

Yeah, I completely forgot to update this thread.

Thank for pointing this out.

jennix
Joomla! Apprentice
Joomla! Apprentice
Posts: 41
Joined: Thu Jul 24, 2008 3:21 am

Re: SSL How to find non-secure items on a page ?

Post by jennix » Sun Dec 28, 2008 11:31 pm

http links in java scripts will do this too.


microsoft sucks

User avatar
johnwasneverhere
Joomla! Intern
Joomla! Intern
Posts: 51
Joined: Sun Jan 08, 2006 12:18 am
Contact:

Re: SSL How to find non-secure items on a page ?

Post by johnwasneverhere » Sat Mar 21, 2009 6:46 am

ok.. What i've done after DAYS of work.. and what worked for me was to
1. make all my images in the css absolute paths...
2. fix any src=' as mentioned above in the source and the biggie...
3. in the joomla config file don't use anything for live site... so it would be livesite=''

i'm not sure if 1 and 2 above really did anything.. but i know that 3 did

hope this helps
"How can you find joy in a joyless place except by realizing you are not there?"

http://www.thecourseinmiracles.com
http://www.uncursodemilagros.com

sitewonders
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 171
Joined: Mon Mar 19, 2007 8:29 am

Re: SSL How to find non-secure items on a page ?

Post by sitewonders » Thu Feb 18, 2010 5:41 pm

3. in the joomla config file don't use anything for live site... so it would be livesite=''

That fixed it for me!!!!!

G

Lorrein
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Tue Oct 06, 2009 7:48 am

Re: SSL How to find non-secure items on a page ?

Post by Lorrein » Sat Sep 18, 2010 7:37 am

This might help.
In module manager go to main module
under advanced select "No caching"

myopicseer
Joomla! Apprentice
Joomla! Apprentice
Posts: 14
Joined: Sat Oct 31, 2009 9:51 pm

Re: SSL How to find non-secure items on a page ?

Post by myopicseer » Tue Dec 07, 2010 3:58 pm

For me the issue appears to be the FLASH "codebase" parameter, which links to http://download.macromedia.com/pub/shoc ... wflash.cab. I am using the Flash Joomla module flash_mod. I am going to try to edit the module file to make the connection a secure connection. I confirmed this as the issue after having looked at the "Page Source" in IE, and doing an F+ctrl to do a search for the term "http". I made all paths relative, or https. When still having the IE popup issue, I temporarily disabled the Flash module in the admin backend, and viola, the warning went away on the checkout (https connection) pages.

cmarotta
Joomla! Fledgling
Joomla! Fledgling
Posts: 4
Joined: Thu Oct 21, 2010 2:49 pm

Re: SSL How to find non-secure items on a page ?

Post by cmarotta » Tue Dec 07, 2010 5:26 pm

johnwasneverhere wrote:ok.. What i've done after DAYS of work.. and what worked for me was to
1. make all my images in the css absolute paths...
2. fix any src=' as mentioned above in the source and the biggie...
3. in the joomla config file don't use anything for live site... so it would be livesite=''

i'm not sure if 1 and 2 above really did anything.. but i know that 3 did

hope this helps
i migrated to a new server... #3 fixed ALLLLL of my problems.
Thankx!!

netfuel
Joomla! Fledgling
Joomla! Fledgling
Posts: 1
Joined: Thu Sep 08, 2011 12:52 pm

Re: SSL How to find non-secure items on a page ?

Post by netfuel » Thu Sep 08, 2011 12:59 pm

I had the same issue in IE I was getting warning messages saying "Only secure content is displayed"

I tried everything. I edited var $live_site = ''; in configuration to var $live_site = 'https://www.domain.com';

I made sure all pages were set to SSL enabled using the parameters for each article in the back-end. I also set the Force SSL to the entire site in the globals, Nothing worked.

The fix for me was, I viewed source, copied the entire code into a html file, uploaded the file, problem still there. I gradually took peice by piece out until I found where the problem was. The problem was inside a css file that was loading fonts from http instead of https. Once I removed that code, my site was secure.

baldnut
Joomla! Apprentice
Joomla! Apprentice
Posts: 18
Joined: Mon Jul 17, 2006 11:43 am

Re: SSL How to find non-secure items on a page ?

Post by baldnut » Sat Sep 17, 2011 5:31 pm

You can have as many links as you want pointing to none secure pages they will never effect your ssl certificate the only time you will have a problem if you are linking with absolute path to an image using http:

So look for any references to <img src="http://domain.com/images/image.jpg" /> this would be far better change to <img src="images/image.jpg" />

Or any references in your css files which call in an image using absolute path, again change like above (updating with the correct paths obvisouly)

Any files you have added in the header such as script tags calling in javascript or jquery files from none https locations.

Google analytics already has code in it to to automatically switch to https if required.

Any links which are <a href="http:// do not need attention as they are not loading the page on your site so do not need to be secure.

Markstein
Joomla! Hero
Joomla! Hero
Posts: 2268
Joined: Sat Feb 09, 2008 8:27 am
Location: California, USA

Re: SSL How to find non-secure items on a page ?

Post by Markstein » Sat Sep 17, 2011 6:09 pm

For others that run into this problem there is an awesome addon for IE and Firefox which gives you the ability to see all "http" references on a "https" page. Makes it very easy to track them down.

http://www.httpwatch.com/

Mark

alfirus
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Wed Sep 21, 2011 1:07 pm

Re: SSL How to find non-secure items on a page ?

Post by alfirus » Wed Sep 21, 2011 1:45 pm

i'm also facing same problem. my site is https://ebaseworks.com.

I'm able to troubleshoot by using firefox, in media tab https://picasaweb.google.com/1164965086 ... 7806743906, i delete script which is not providing SSL for my site.

I also checking every images using relative url in my .php files and also in my css.

$live_site already as ''

Almost feedup.

alfirus
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Wed Sep 21, 2011 1:07 pm

Re: SSL How to find non-secure items on a page ?

Post by alfirus » Wed Sep 21, 2011 2:11 pm

Wrong info... post deleted

sarahania
Joomla! Fledgling
Joomla! Fledgling
Posts: 4
Joined: Mon Jul 23, 2012 2:51 pm

Re: SSL How to find non-secure items on a page ?

Post by sarahania » Wed Aug 01, 2012 10:39 am

is that a SSL installation problem or Joomla, I am suffering !, as lot of my site pages down with addition of SSL

GVerheij
Joomla! Apprentice
Joomla! Apprentice
Posts: 18
Joined: Wed Feb 16, 2011 3:58 pm

Re: SSL How to find non-secure items on a page ?

Post by GVerheij » Wed Nov 07, 2012 9:57 am

Hi, try this website: http://www.whynopadlock.com/

I've used it at a few times on SSL-sites, You can fill in the URL of your page and it generates a very usefull overview of alle secure and non-secure links on your page.

Regards, Gerard

2mino
Joomla! Apprentice
Joomla! Apprentice
Posts: 35
Joined: Sun Jul 28, 2013 8:29 am

Re: SSL How to find non-secure items on a page ?

Post by 2mino » Mon Aug 12, 2013 9:02 am

Thanks!
Worked fine for me too!
http://babya.ir/
http://karajab.ir/replacement-water-filters/ - تعویض فیلتر دستگاه تصفیه آب


Locked

Return to “Security - 1.0.x”