Post by jstuardo » Thu Jul 30, 2020 11:16 pm

Hello,

I just installed OpenCart 3.0.3.3 and configured SSL, however, the following URL's are generated using http instead of https:

  • all information pages
  • /index.php?route=information/contact
  • /index.php?route=information/sitemap
  • /index.php?route=product/manufacturer
  • /index.php?route=product/special
  • /index.php?route=checkout/cart
  • /index.php?route=common/home
All other links, including categories menu, are correctly with SSL.

How can I solve it? is this a problem of the default template and should I correct it editing twig templates?

Thanks
Jaime

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by IP_CAM » Fri Jul 31, 2020 12:34 am

Show us the content of your config.php file (except for the Access credentials ... :laugh: )

My Github OC Site: https://github.com/IP-CAM
5'600 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.


User avatar
Legendary Member

Posts

Joined
Tue Mar 04, 2014 1:37 am
Location - Switzerland

Post by jstuardo » Fri Jul 31, 2020 1:00 am

This is:

Code: Select all

// HTTP
define('HTTP_SERVER', 'http://tienda.zzz.com/');

// HTTPS
define('HTTPS_SERVER', 'https://tienda.zzz.com/');

// DIR
define('DIR_APPLICATION', '/home/zzz/tienda/catalogo/catalog/');
define('DIR_SYSTEM', '/home/zzz/tienda/catalogo/system/');
define('DIR_IMAGE', '/home/zzz/tienda/catalogo/image/');
define('DIR_STORAGE', '/home/zzz/tienda/storage/');
define('DIR_LANGUAGE', DIR_APPLICATION . 'language/');
define('DIR_TEMPLATE', DIR_APPLICATION . 'view/theme/');
define('DIR_CONFIG', DIR_SYSTEM . 'config/');
define('DIR_CACHE', DIR_STORAGE . 'cache/');
define('DIR_DOWNLOAD', DIR_STORAGE . 'download/');
define('DIR_LOGS', DIR_STORAGE . 'logs/');
define('DIR_MODIFICATION', DIR_STORAGE . 'modification/');
define('DIR_SESSION', DIR_STORAGE . 'session/');
define('DIR_UPLOAD', DIR_STORAGE . 'upload/');
Since the site is configured as SSL, HTTPS setting is used, isn't it? Maybe I should change both HTTPS and HTTP, but I don't think so.

Regards
Jaime

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by IP_CAM » Fri Jul 31, 2020 1:51 am

I figured, it's either:

Code: Select all

// HTTP
define('HTTP_SERVER', 'http://tienda.zzz.com/');
// HTTPS
define('HTTPS_SERVER', 'http://tienda.zzz.com/');
or then:

Code: Select all

// HTTP
define('HTTP_SERVER', 'https://tienda.zzz.com/');
// HTTPS
define('HTTPS_SERVER', 'https://tienda.zzz.com/');
depending on, how the Site is accessed by default.
Ernie

My Github OC Site: https://github.com/IP-CAM
5'600 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.


User avatar
Legendary Member

Posts

Joined
Tue Mar 04, 2014 1:37 am
Location - Switzerland

Post by sw!tch » Fri Jul 31, 2020 1:55 am

After this change, you might want to add a rewrite rule to your .htaccess to redirect http to https.

Backup and learn how to recover before you make any changes!


Active Member

Posts

Joined
Sat Apr 28, 2012 2:32 pm

Post by jstuardo » Fri Jul 31, 2020 2:32 am

IP_CAM wrote:
Fri Jul 31, 2020 1:51 am
I figured, it's either:

Code: Select all

// HTTP
define('HTTP_SERVER', 'http://tienda.zzz.com/');
// HTTPS
define('HTTPS_SERVER', 'http://tienda.zzz.com/');
or then:

Code: Select all

// HTTP
define('HTTP_SERVER', 'https://tienda.zzz.com/');
// HTTPS
define('HTTPS_SERVER', 'https://tienda.zzz.com/');
depending on, how the Site is accessed by default.
Ernie
That's the point. If the site is configured to use SSL, why HTTP_SERVER setting is used sometimes?

On the other hand, I told that some links are http and other https. For example, https://tienda.yyy.com/index.php?route= ... return/add or https://tienda.yyy.com/index.php?route=account/account are correctly using SSL.

Can you explain me why some links at the bottom of the page uses SSL while other don't? It seems something like a bug to me, or maybe the default template has this pronlem.

Regards
Jakme

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by IP_CAM » Fri Jul 31, 2020 2:34 am

you might find some answers on this here:
viewtopic.php?f=190&t=219272#p794862

My Github OC Site: https://github.com/IP-CAM
5'600 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.


User avatar
Legendary Member

Posts

Joined
Tue Mar 04, 2014 1:37 am
Location - Switzerland

Post by jstuardo » Fri Jul 31, 2020 2:36 am

sw!tch wrote:
Fri Jul 31, 2020 1:55 am
After this change, you might want to add a rewrite rule to your .htaccess to redirect http to https.
Thanks. I can do that but that is a way to ensure that an ordinary user tried to connect to http instead of https. In this case, it will act also as a patch to a bad behaviour of the Open Cart platform.

As I explained in other post, some links have correct addressed as https while others addressed as http. That sounds this to be a bug.

Regards
Jaime

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by IP_CAM » Fri Jul 31, 2020 2:39 am

It's sure not a Bug, you just don't understand the system, as it looks ...

My Github OC Site: https://github.com/IP-CAM
5'600 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.


User avatar
Legendary Member

Posts

Joined
Tue Mar 04, 2014 1:37 am
Location - Switzerland

Post by jstuardo » Fri Jul 31, 2020 2:46 am

IP_CAM wrote:
Fri Jul 31, 2020 2:34 am
you might find some answers on this here:
viewtopic.php?f=190&t=219272#p794862
i read that link but I did not find any related to the problem. Problem there is concerning images and fonts. That is not my case. My case is regarding https or http in page links.

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by jstuardo » Fri Jul 31, 2020 3:03 am

IP_CAM wrote:
Fri Jul 31, 2020 2:39 am
It's sure not a Bug, you just don't understand the system, as it looks ...
Hello.... let me teach you what I have found out so that you will learn. I am an engineer who also develops complex systems in many programming languages. Since I always need to know the base of a problem instead of trying to patch it to hide the origin of it, I have browsed source code and I have found this is really a bug or maybe developers do that way on purpose, I don't know.

Please open this file:

Code: Select all

\catalog\controller\common\footer.php
If you know how to develop software, you will notice immediately this:

Code: Select all

foreach ($this->model_catalog_information->getInformations() as $result) {
			if ($result['bottom']) {
				$data['informations'][] = array(
					'title' => $result['title'],
					'href'  => $this->url->link('information/information', 'information_id=' . $result['information_id'])
				);
			}
		}

		$data['contact'] = $this->url->link('information/contact');
		$data['return'] = $this->url->link('account/return/add', '', true);
		$data['sitemap'] = $this->url->link('information/sitemap');
		$data['tracking'] = $this->url->link('information/tracking');
		$data['manufacturer'] = $this->url->link('product/manufacturer');
		$data['voucher'] = $this->url->link('account/voucher', '', true);
		$data['affiliate'] = $this->url->link('affiliate/login', '', true);
		$data['special'] = $this->url->link('product/special');
		$data['account'] = $this->url->link('account/account', '', true);
		$data['order'] = $this->url->link('account/order', '', true);
		$data['wishlist'] = $this->url->link('account/wishlist', '', true);
		$data['newsletter'] = $this->url->link('account/newsletter', '', true);
Do you see the "true" there? well.... that tells the system that the URL is secure, as this other piece of code shows:

Code: Select all

/**
	 * 
	 *
	 * @param	string		$route
	 * @param	mixed		$args
	 * @param	bool		$secure
	 *
	 * @return	string
 	*/
	public function link($route, $args = '', $secure = false) {
		if ($this->ssl && $secure) {
			$url = $this->ssl . 'index.php?route=' . $route;
		} else {
			$url = $this->url . 'index.php?route=' . $route;
		}
		
		if ($args) {
			if (is_array($args)) {
				$url .= '&' . http_build_query($args);
			} else {
				$url .= str_replace('&', '&', '&' . ltrim($args, '&'));
			}
		}
		
		foreach ($this->rewrite as $rewrite) {
			$url = $rewrite->rewrite($url);
		}
		
		return $url; 
	}
As you see, third parameter tells if the link is secured or not.

The call should only has a "true" in the third parameter, always. I understand now why some links have https and why others don't.

The fact is that it should be true for all links. If some site does not use SSL, following code will be executed instead, even when the third parameter is true:

Code: Select all

$url = $this->url . 'index.php?route=' . $route;
It seems I understand the system more than you ;D

Regards
Jaime

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by sw!tch » Fri Jul 31, 2020 3:06 am

jstuardo wrote:
Fri Jul 31, 2020 2:32 am

That's the point. If the site is configured to use SSL, why HTTP_SERVER setting is used sometimes?
It was common to run non-secure pages in http and your checkout / account pages in https mainly for speed. Many years ago SSL was slow, CDN's had poor support, some hosting providers actually had separate folders for https content..and browsers handled it like a snail. Nowadays with modern browsers and TLS improvements it's more common to run websites under full https.

The HTTP and HTTPS config is presumably carried over from the years. I can't see any point of running a modern website under http in 2020.

Backup and learn how to recover before you make any changes!


Active Member

Posts

Joined
Sat Apr 28, 2012 2:32 pm

Post by jstuardo » Fri Jul 31, 2020 3:36 am

sw!tch wrote:
Fri Jul 31, 2020 3:06 am
jstuardo wrote:
Fri Jul 31, 2020 2:32 am

That's the point. If the site is configured to use SSL, why HTTP_SERVER setting is used sometimes?
It was common to run non-secure pages in http and your checkout / account pages in https mainly for speed. Many years ago SSL was slow, CDN's had poor support, some hosting providers actually had separate folders for https content..and browsers handled it like a snail. Nowadays with modern browsers and TLS improvements it's more common to run websites under full https.

The HTTP and HTTPS config is presumably carried over from the years. I can't see any point of running a modern website under http in 2020.
I agree. I have developed systems for many years and at the beginning, I also used SSL only for authentication. Nowadays, it is rare to find a serious site that did not implement SSL for all pages. And in fact, when I load a site that is not secure, I prefer to close the browser and look for information in other sites.

Well... regarding OpenCart problem, I have fixed it by changing $this->url->link call in corresponding controllers. Yes, I should not modify core files because this will be overwritten by a platform update, but I hope OpenCart developers will change that :D

However, even that fix is in place I will change .htaccess to redirect all http traffic to https.

As a side note for OpenCart developers. Maybe they could consider, if someone configures the store to use SSL, if an http request is received, platform could redirect to https counterpart.

Regards
Jaime

New member

Posts

Joined
Sat Apr 03, 2010 8:52 am

Post by ADD Creative » Fri Jul 31, 2020 5:05 am

jstuardo wrote:
Fri Jul 31, 2020 3:36 am
As a side note for OpenCart developers. Maybe they could consider, if someone configures the store to use SSL, if an http request is received, platform could redirect to https counterpart.
That's probably best done in the .htaccess, as you will want to redirect requests for static files as well.

www.add-creative.co.uk


Guru Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom

Post by paulfeakins » Fri Jul 31, 2020 6:27 pm

Wow, what a long thread when the simple answer is just make sure it's HTTPS everywhere in both config files and job done.

UK OpenCart Hosting | OpenCart Audits | OpenCart Support - please email info@antropy.co.uk


User avatar
Legendary Member

Posts

Joined
Mon Aug 22, 2011 11:01 pm
Location - London Gatwick, United Kingdom

Post by madmaxb » Thu Dec 05, 2024 12:54 am

OC 3.0.4 and the problem is still there.
The thread is long because all provided solutions just mask a problem but not resolve it.
There should not be a place for magic or some god feeling in big system development.

So OC development team just need to update its routing for new reality and fix one line of code:
public function link($route, $args = '', $secure = false true) {

This is all just about lost time. You install some module and get in trouble. Then you look for a solution to fix the trouble which root is system core.

Your skilled IT team
The right experts in solving business tasks of any complexity.


User avatar
Newbie

Posts

Joined
Wed Mar 08, 2017 5:49 am


Post by OSWorX » Thu Dec 05, 2024 1:53 am

madmaxb wrote:
Thu Dec 05, 2024 12:54 am
OC 3.0.4 and the problem is still there.
The thread is long because all provided solutions just mask a problem but not resolve it.
There should not be a place for magic or some god feeling in big system development.

So OC development team just need to update its routing for new reality and fix one line of code:
public function link($route, $args = '', $secure = false true) {

This is all just about lost time. You install some module and get in trouble. Then you look for a solution to fix the trouble which root is system core.
Your signature says something, your posting another story!

First, there is no version 3.0.4.
Second (see your "skilled IT team"): with OC 4.x this is past - so why hijacking an old thread?
Wanna make promotion?

Full Stack Web Developer :: Dedicated OpenCart Development & Support DACH Region
Contact for Custom Work / Fast Support.


User avatar
Administrator

Posts

Joined
Mon Jan 11, 2010 10:52 pm
Location - Austria

Post by ADD Creative » Thu Dec 05, 2024 6:05 pm

madmaxb wrote:
Thu Dec 05, 2024 12:54 am
OC 3.0.4 and the problem is still there.
The thread is long because all provided solutions just mask a problem but not resolve it.
There should not be a place for magic or some god feeling in big system development.

So OC development team just need to update its routing for new reality and fix one line of code:
public function link($route, $args = '', $secure = false true) {

This is all just about lost time. You install some module and get in trouble. Then you look for a solution to fix the trouble which root is system core.
That wouldn't completely solve the issue as HTTP_SERVER is still used directly in the code in places.

I agree the issue is confusing to people new to OpenCart who make the mistake of not using https when installing. I can't see any changes being made to 3.0.x as this is just now maintenance releases. Perhaps updating the documentation would be the best option.

www.add-creative.co.uk


Guru Member

Posts

Joined
Sat Jan 14, 2012 1:02 am
Location - United Kingdom
Who is online

Users browsing this forum: No registered users and 16 guests