OpenCart Community

OC v 3.0.3.9

I've been doing minor stylesheet file changes and decided to see how everything looks on my phone and all I get are large images and text links.

I just did a search and someone had the same exact issue a couple years ago and somebody replied "config and htaccess files". Do I need to do something specific with those to make the site responsive? Or is it supposed to be responsive right out of the box?

Or could I have messed up something with the css file changes I have been making, just messing around with colors and minor stuff, but is it possible I deleted something in the stylesheet file I should not have?

Are you using the correct URL in regards to https/http and www/no www?

Yes.

It's weird, on a tablet that is 15 years old, it displays fine. On my much newer Galaxy S22, it shows links and oversized images.

pop the url and someone will take a look for you, im sure.

ggrant3 wrote: ↑

Tue May 28, 2024 6:22 am

Or could I have messed up something with the css file changes I have been making, just messing around with colors and minor stuff, but is it possible I deleted something in the stylesheet file I should not have?

Anything is possible but we can't magically tell you without seeing the site.

I fixed it.

I added the following to the root htaccess file to force all pages to be https and it's working perfectly now on mobile

Well done, and thanks for sharing your solution with us.
Please add '[SOLVED]' to the beginning of the original form thread title.

ggrant3 wrote: ↑

Wed May 29, 2024 4:52 am

I fixed it.

I added the following to the root htaccess file to force all pages to be https and it's working perfectly now on mobile

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
<ifModule mod_headers.c>
Header always set Content-Security-Policy "upgrade-insecure-requests;"
</IfModule>

Never use %{HTTP_HOST} in redirects unless you check for validity first as the value is user defined and can hold external domain reference, i.e. your site can be used to DOS another. If you don't validate, set it to you domain specifically.

ADD Creative wrote: ↑

Tue May 28, 2024 4:20 pm

Are you using the correct URL in regards to https/http and www/no www?

ooooooowwww this guy is good!!!

nonnedelectari wrote: ↑

Wed May 29, 2024 7:52 am

ggrant3 wrote: ↑

Wed May 29, 2024 4:52 am

I fixed it.

I added the following to the root htaccess file to force all pages to be https and it's working perfectly now on mobile

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
<ifModule mod_headers.c>
Header always set Content-Security-Policy "upgrade-insecure-requests;"
</IfModule>

Never use %{HTTP_HOST} in redirects unless you check for validity first as the value is user defined and can hold external domain reference, i.e. your site can be used to DOS another. If you don't validate, set it to you domain specifically.

TBH, I'm not knowledgeable enough to fully understand what you mean. I get the fact that someone can somehow use my domain to DOS someone else because of the code, but:
1. How do I check for validity first (and what does that mean)?
2. And/or How do I set it to my specific domain?

Depending on how your hosting is set up it could already be validated.

If you are only hosting one domain you could replace %{HTTP_HOST} with your domain. Although that won't be compatible with HSTS preload if redirecting www or non-www.

ADD Creative wrote: ↑

Thu May 30, 2024 3:04 am

Depending on how your hosting is set up it could already be validated.

If you are only hosting one domain you could replace %{HTTP_HOST} with your domain. Although that won't be compatible with HSTS preload if redirecting www or non-www.

I'm hosting this site under another site's main hosting account. using a subfolder under the main domain.

That might restrict the domain, but it might still be possible to redirect using the subdirectory of the main site.