0

Is there a way to secure the Friends forms?

I use ssl for the members section and friends is used there as well. All friends forms are giving me the non-secure message when trying to submit...

I have tried several options, none of them works. Almost thinking to alter the module code to force, only use, ssl

{exp:friends:message_folder_form 
return="{current_url}" 
form_class="form-horizontal" 
form_id="accounForm" 
secure_action="yes"  
secure_return="yes"}

<input type="hidden" name="secure_action" value="yes">
<input type="hidden" name="secure_return" value="yes">
Improve this question

1 Answer 1

Reset to default
0

Unfortunately this feature isn't available as of this writing.

I recommend submitting this as a Feature Request under the specific add-on category. It'll also give other users the option to vote up the feature request, and help us prioritize features to add in upcoming versions of this add-on. http://support.solspace.com/support/discussions

As a workaround for now, you could hard-code an https:// URL in the return="" parameter to replace the non-existent secure_return="yes" parameter functionality, and use javascript/jQuery to change the <form>'s action="" attribute to contain https:// instead of http://.

Alternatively for both cases, you could use the protocol-agnostic // instead as al alternative. Eg. use return="//mysite.com/etc" and use javascript/jQuery to change the action="" <form> attribute to action="//mysite.com/etc". This would cover both http and https cases.

Improve this answer
4
  • Ah ok, but this gives me some messages as well, forms that are not send secure. Is there a way to alter the friends code. All used friend forms need to be secure....
    – Gfive
    May 30, 2014 at 15:32
  • Can you elaborate on that? If the return parameter is https, and the form's action="" attribute is https (or both are using // instead), then what else is missing?
    – Solspace
    May 30, 2014 at 20:59
  • Using //www. in the return variable. still does give me the ! mark in the secure icon, instead of the lock. So when I want, for example, edit a folder (exp:friends:message_folder_form) I get a security warning. Form RET and action are still http://. That's why I want to hard code the https into friends. While friends is being used only in a secured environment. All other elements like, css, java and other modules/extensions are working, even Users module, in the secure environment. Except Friends. Altering the site_url into //www. is not an option
    – Gfive
    May 31, 2014 at 8:49
  • Everything on a page indeed needs to be https for that "lock icon" to display. You would have to use javascript/jQuery to change the RET url to https as well for now. Alternatively, since RET is generated using EE's fetch_current_uri function, I would try having the URL of the page with {exp:friends:message_folder_form} code be https, which should have RET be https as well. Finally, I would file a Feature Request at support.solspace.com/support/discussions
    – Solspace
    Jun 2, 2014 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.