1

Say I force SSL on my public login page (with DM Force SSL), and I'm using a fairly standard freemember login form:

{exp:freemember:login return="PREVIOUS_URL" error_handling="inline" error_delimiters='<span class="error">|</span>'}

bla bla

{/exp:freemember:login}

When the login form is submitted, Safari will throw this in a dropdown sheet:

This form will be sent in a way that is not secure. Are you sure you want to send it?

Is this because freemember lacks the ability to send the form securely? (Solspace's Freeform Pro, for instance, has a secure_action="yes" attribute for its tags. Is there some workaround?

1

Aha.

Secure Form (https) - Feature Request

would be great if you could specify that the form action should be secure. i did this by adding the following to the _build_form method in mod.freemember.php:

if ($this->EE->TMPL->fetch_param('secure_action') == 'yes')
{
$data['action'] = str_replace('http:', 'https:', $data['action']);
}
| improve this answer | |
  • 1
    Spot on. We will add this feature in our next release, in the meantime you can use the code in that feature request to achieve what you need. – Adrian Macneil Feb 7 '13 at 6:24
  • I've just added this to the latest master branch if you care to test it: github.com/expressodev/freemember/archive/master.zip – Adrian Macneil Feb 9 '13 at 4:07
  • Very nice! Might be worth updating each file in the Freemember docs (e.g. register_tag.md) with the info on secure_action="yes" and secure_return="yes" paramaters. If (like me) you are forcing SSL via .htaccess on your login/register page, but didn't include the paramaters , new registrations will fail (page just reloads with a blank form). – James Muspratt Apr 8 '13 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.