X-Cart forums

[DavyMac]

When renewing our SSL certificate today I discovered that all our site's https pages do not displaying the secure padlock symbol because resources on the page are from an insecure source, namely xbanners and banners managed by xTreme_Gear.

Sure enough all xbanners have an http:// path on an https:// page. Any solution I can think of is made more complex by our use of MAXcdn, so all the images have a url like http://cdn.mydomain.com/

Any thoughts?

[carpeperdiem]

Originally Posted by DavyMac

When renewing our SSL certificate today I discovered that all our site's https pages do not displaying the secure padlock symbol because resources on the page are from an insecure source, namely xbanners and banners managed by xTreme_Gear.

Sure enough all xbanners have an http:// path on an https:// page. Any solution I can think of is made more complex by our use of MAXcdn, so all the images have a url like http://cdn.mydomain.com/

Any thoughts?

Read my posts about this issue in this thread ? Search this thread for https.

[DavyMac]

Originally Posted by carpeperdiem

Read my posts about this issue in this thread ? Search this thread for https.

I've now read your work-a-round - What a downer! I was planning on using the IP filter functionality on xBanners to serve up a geo-location specific banner for overseas customers but I won't be able to do that with hardcoded image paths!

I see that when you first discovered this failure with the TXS modules you raised tickets with TXS. What was their response?

[carpeperdiem]

Originally Posted by DavyMac

I've now read your work-a-round - What a downer! I was planning on using the IP filter functionality on xBanners to serve up a geo-location specific banner for overseas customers but I won't be able to do that with hardcoded image paths!

I see that when you first discovered this failure with the TXS modules you raised tickets with TXS. What was their response?

TXS has failed to acknowledge or respond to any of my questions to them regarding secure images / https. I have bumped and sent reminders to them about these open issues, to no avail. Fortunately, it's not rocket science. But it does require not using the features of xtreme.

I think you will still be able to do what you need with geo-IP, but just don't hardcode the paths. Yes ??

I also made posts in the Xmenus thread about how to solve the https issue in xmenus.

This could have all been prevented and sorted out had TXS simply put a five dollar SSL certificate on their demo site. And yes, I did make this suggestion to them…

You simply need to look at page source while in https and search for http: And see if you discover any images or links to JavaScript or CSS that doesn't belong.

[DavyMac]

I realise that I can only concentrate on one thing at a time, which is my excuse for missing all the posts in this thread regarding TXS presenting insecure images in their templates and modules.

I promise to try harder at keeping up to date with people's posts

Thanks to Jeremy for his posts on making images secure, you certainly keep us xcarters on the straight and narrow. In fact standing on the shoulders of Jeremy's work I have been able to modify my template so that all images and banners are secure on https pages AND they are still managed by extreme gear's admin interface. Here is what I did:

In file file smarty.php:

After

PHP Code:

$smarty->assign('SkinDir', $xcart_web_dir . $smarty_skin_dir); 


Insert

PHP Code:

if ($_SERVER['HTTPS'] != 'on') 
{ 
$smarty->assign("XGImagesDir", "http://www.domain.com/images/XG"); // If you use CDN replace www with cdn
 
} 
else 
{ 
$smarty->assign('XGImagesDir', $xcart_web_dir . '/images/XG'); 
} 


Although it is unlikely you will need to change your logo often I have included here a fix for that too:

In file skin/extreme_gear/customer/head.tpl

Replace

 <a href="{if $xg_config.top_logo_url ne ''}{$xg_config.top_logo_url}{else}/{/if}" {if $xg_config.top_logo_title ne ''}title="{$xg_config.top_logo_title}"{/if} {if $xg_config.top_logo_target ne ''}target="{$xg_config.top_logo_target}"{/if} id="logo-main"><img src="{$xg_top_logo.image_url}" {if $xg_top_logo.image_x ne ''}width="{$xg_top_logo.image_x}"{/if} {if $xg_top_logo.image_y ne ''}height="{$xg_top_logo.image_y}"{/if} {if $xg_config.top_logo_alt ne ''}alt="{$xg_config.top_logo_alt}"{/if} /></a>

With

 <a href="{if $xg_config.top_logo_url ne ''}{$xg_config.top_logo_url}{else}/{/if}" {if $xg_config.top_logo_title ne ''}title="{$xg_config.top_logo_title}"{/if} {if $xg_config.top_logo_target ne ''}target="{$xg_config.top_logo_target}"{/if} id="logo-main"><img src="{$XGImagesDir}{$xg_top_logo.image_path|replace:'./images/XG':''}" {if $xg_top_logo.image_x ne ''}width="{$xg_top_logo.image_x}"{/if} {if $xg_top_logo.image_y ne ''}height="{$xg_top_logo.image_y}"{/if} {if $xg_config.top_logo_alt ne ''}alt="{$xg_config.top_logo_alt}"{/if} /></a>

To get the banners secure ( the Footer Left Banner, Footer Right Banner, and the Quick Links Right Banner)
in file skin/common_files/modules/TXS_Xtreme_Gear/xg_front_image.tpl
Replace

 <img src="{$xg_images.$type.image_url}"

With

 <img src="{$XGImagesDir}/{$xg_images.$type.filename}"

If you use xMultiCurrency then to get the little flag icon to be secure
In file skin/common_files/modules/XMultiCurrency/customer/complex_selector.tpl
Around line 114 find

 <img src="{$curlng.tmbn_url|amp}"

Replace with

 <img src="{$XGImagesDir}/../..{$curlng.image_path|replace:'./':'/'}"

These changes have worked for me and I hope they work for you too.

[carpeperdiem]

Originally Posted by DavyMac

These changes have worked for me and I hope they work for you too.

Cool. I already hardcoded everything, but hopefully TXS will use your work in the 4.6.1 version of xtreme. If not, it's here for the community! Thanks for sharing!!!!

J

[jcrim]

Originally Posted by carpeperdiem

Cool. I already hardcoded everything, but hopefully TXS will use your work in the 4.6.1 version of xtreme. If not, it's here for the community! Thanks for sharing!!!!

J

Good point. Has anyone actually notified or put in a ticket with the xCart Store to receive some form of a response?

This functionality would be a requirement for any store owner building the appropriate security and trust for their customers.

-Jesse

[carpeperdiem]

Originally Posted by jcrim

Good point. Has anyone actually notified or put in a ticket with the xCart Store to receive some form of a response?

This functionality would be a requirement for any store owner building the appropriate security and trust for their customers.

-Jesse

TXS never answered my tickets re: images when site goes to https.
But some of us have made posts for workarounds here.
Hate to suggest this - but until dozens of customers start beating TXS up on this, they may not feel it's worth their attention.

[jcrim]

Originally Posted by carpeperdiem

TXS never answered my tickets re: images when site goes to https.
But some of us have made posts for workarounds here.
Hate to suggest this - but until dozens of customers start beating TXS up on this, they may not feel it's worth their attention.

Understood. I agree and have put in a ticket with TXS to increase the awareness of this issue and show my concern. If any output or resolution provided, I will update the group.

I appreciate all the effort and workarounds thus given so far.

-Jesse

[Will Hayes]

Hi Guys,

Just letting you know... this update to xBanners is on our list - we plan to tackle it this week and provide a fix.

regards
Will.