1

Say I force SSL on my public login page (with DM Force SSL), and I'm using a fairly standard freemember login form:

{exp:freemember:login return="PREVIOUS_URL" error_handling="inline" error_delimiters='<span class="error">|</span>'}

bla bla

{/exp:freemember:login}

When the login form is submitted, Safari will throw this in a dropdown sheet:

This form will be sent in a way that is not secure. Are you sure you want to send it?

Is this because freemember lacks the ability to send the form securely? (Solspace's Freeform Pro, for instance, has a secure_action="yes" attribute for its tags. Is there some workaround?

1 Answer 1

1

Aha.

Secure Form (https) - Feature Request

would be great if you could specify that the form action should be secure. i did this by adding the following to the _build_form method in mod.freemember.php:

if ($this->EE->TMPL->fetch_param('secure_action') == 'yes')
{
$data['action'] = str_replace('http:', 'https:', $data['action']);
}
3
  • 1
    Spot on. We will add this feature in our next release, in the meantime you can use the code in that feature request to achieve what you need. Feb 7, 2013 at 6:24
  • I've just added this to the latest master branch if you care to test it: github.com/expressodev/freemember/archive/master.zip Feb 9, 2013 at 4:07
  • Very nice! Might be worth updating each file in the Freemember docs (e.g. register_tag.md) with the info on secure_action="yes" and secure_return="yes" paramaters. If (like me) you are forcing SSL via .htaccess on your login/register page, but didn't include the paramaters , new registrations will fail (page just reloads with a blank form). Apr 8, 2013 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.