PrestaShop Forum

The best place in the world to ask questions about PrestaShop and get advice from our passionate community!

PrestaShop Forum

Jump to content

 

CRITICAL SSL BUG in PS 1.4.7 - Fix inside.

66 replies to this topic
#1
tomerg3

    PrestaShop Superstar

  • US Moderators
  • 5753 posts
PS 1.4.7 will redirect all payment module pages from https:// to http:// virtually breaking any hosted payment module that uses SSL.

Edit /classes/FrontController.php line #87 (normally, you do not want to change any class file directly, but this is an exception as this will likely be fixed in 1.4.7.1 very soon).

Remove the following code

else if (Configuration::get('PS_SSL_ENABLED') AND Tools::usingSecureMode() AND !($this->ssl))
{
header('HTTP/1.1 301 Moved Permanently');
header('Location: '.Tools::getShopDomain(true).$_SERVER['REQUEST_URI']);
exit();
}

Save the file, and upload to your server.
Posted Image
For the latest updates discount coupons and new module information follow us on Twitter , Facebook ,and tips on our Blog
Please do not send general questions via PM, that is what the forum is for...

#2
terrytoledo

    PrestaShop Newbie

  • Members
  • Pip
  • 16 posts
Wow! This works! Tomer, you are a pro! Thanks so much, I am very grateful to have purchased a module with you. Cheers!

#3
medfordite

    PrestaShop Apprentice

  • Members
  • PipPip
  • 39 posts
THANK YOU for posting this.

I was looking for a solution last night, came back today to your site being turned off for updates/upgrades and then this was here. :)

#4
tank

    PrestaShop Apprentice

  • Members
  • PipPip
  • 39 posts
Thanks Tomer, that fixed the Offline Credit Card module

#5
shacker

    PrestaShop Superstar

  • Moderators
  • 5414 posts
Thanks a lot tomerg (i have not tested 1.4.7 yet)

#6
philee

    PrestaShop Apprentice

  • Members
  • PipPip
  • 336 posts
Great work Tomerg. :)

#7
Carl Favre

    Community Addict

  • PrestaTeam
  • 3463 posts
Hi everyone,

As Tomer said, this issue is going to be fixed real soon.

Meanwhile you can already fix it with the following change :

Edit /header.php and replace the following two lines :

$controller = new FrontController();
$controller->displayHeader();

with

// Save the value of $useSSL ($useSSL will be overwritten by FrontController::__contruct())
$hackSSL = false;
if (isset($useSSL) and $useSSL)
    $hackSSL = true;
   
$controller = new FrontController();

// If $useSSL was set to "true", then overwrite its value to true
if ($hackSSL)
    $useSSL = $controller->ssl = true;
   
$controller->displayHeader();

Carl FavreCommunity Manager | Manager de CommunautéPrestaShop

#8
mir-aus

    PrestaShop Apprentice

  • Members
  • PipPip
  • 112 posts
Hi there

Also I need edit /classes/FrontController.php line #87 or no need after Edit /header.php??

Please advise me.

#9
darvidc

    PrestaShop Apprentice

  • Members
  • PipPip
  • 35 posts
Good question Mir-aus !

Do we have to just change "header.php" or both "header.php" AND "/classes/FrontController.php" ??

Please let us know

David C

#10
cyclehappy

    PrestaShop Newbie

  • Members
  • Pip
  • 1 posts
Tomer you are a code STAR! Thanks my site is back to working GREAT :)

#11
Bradley Clampitt

    PrestaShop Apprentice

  • Members
  • PipPip
  • 30 posts
I would say use Carl's code because it leaves things intact just adds an if else statement to figure out which is needed or necessary.

#12
darvidc

    PrestaShop Apprentice

  • Members
  • PipPip
  • 35 posts
Ok thanks Bradly.

Not being so well informed about when and how a new version is released, can I guess it won't be far of because this is quite a serious bug, if I understand things correctly ?

Any idea when a new PS update will come anybody (I'm on the verg of going live with v1.4.7.0 to replace our ageing Oscommerce site) as it would be nice to have a cleaner version to start with, with over 10,000 customers on our books?

David C

#13
Bradley Clampitt

    PrestaShop Apprentice

  • Members
  • PipPip
  • 30 posts
I would say that 1.5 will be out of beta once they have a good majority of the testers come back with little or no new bugs. I am still on 1.4.4.0 but my test site is running 1.4.7.0 and it seems pretty complete, there will be a 1.4.7.1 or higher I am sure in the next couple of weeks (maybe?).

I am kind of doing the same thing, working on getting more familiar with prestashop and working on my other code (parts of the site). Going to start integration of my site's user management with prestashop in another week or so then add a forums integration... so if they delayed the 1.5 for awhile I will be busy till then.

Also I would suggest not installing 1.5 the day it is released, I would give it a couple of days and check the forums to see what issues or success is had especially with your size of customer database.

#14
darvidc

    PrestaShop Apprentice

  • Members
  • PipPip
  • 35 posts
Thanks for the reply Bradly.

I hope, as you say a 1.4.7.1 will come in the next two weeks (maybe) that would be perfect for me. I was to quick to go to from what seemed a 1.4.6.2 that was working "OK" to a 1.4.7.0, I should have realised that such a larger release would have a few bugs and have waited for the 1.4.7.1 B)

I've got no need for multi-shops so I don't feel a need to wait for the 1.5 and I think there, if and when I update again, I'll give the 1.5 a few updates before (if) I do it! :rolleyes:

#15
mir-aus

    PrestaShop Apprentice

  • Members
  • PipPip
  • 112 posts
I just edit /classes/FrontController.php line #87. if I edit what PS team said, website doesn't work well on payment page.

#16
dikigo

    PrestaShop Newbie

  • Members
  • Pip
  • 1 posts
which one is the best?

#17
Carl Favre

    Community Addict

  • PrestaTeam
  • 3463 posts
Hi dikigo,

You should use the one I gave. Do not forget to always backup your files before doing any changes.
Carl FavreCommunity Manager | Manager de CommunautéPrestaShop

#18
Benjamin V

    PrestaShop Newbie

  • Members
  • Pip
  • 3 posts

View PostCarl Favre, on 29 February 2012 - 09:26 AM, said:

Hi dikigo,

You should use the one I gave. Do not forget to always backup your files before doing any changes.

I've tried the fix you've posted, but the Offsite redirect still doesn't work.

#19
Chaney

    PrestaShop Apprentice

  • Members
  • PipPip
  • 44 posts
I have tried this fix to no avail and we're losing sales. Paypal will not go to the confirmation!! Please help!!!

Thank you
Deborah

I tried the two fixes - this is what I receive when I try to make an order:

Authorisation to PayPal failed


Please refer to logs:
  • PayPal response:
  • TIMESTAMP -> 2012-03-01T15:54:23Z
  • L_ERRORCODE0 -> 10002
  • L_SHORTMESSAGE0 -> Security error
  • L_LONGMESSAGE0 -> Security header is not valid
  • L_SEVERITYCODE0 -> Error
  • PayPal returned error
« Back

#20
Slidster

    PrestaShop Newbie

  • Members
  • Pip
  • 6 posts

View PostChaney, on 01 March 2012 - 04:46 PM, said:

I have tried this fix to no avail and we're losing sales. Paypal will not go to the confirmation!! Please help!!!

Thank you
Deborah

I tried the two fixes - this is what I receive when I try to make an order:

Authorisation to PayPal failed


Please refer to logs:
  • PayPal response:
  • TIMESTAMP -> 2012-03-01T15:54:23Z
  • L_ERRORCODE0 -> 10002
  • L_SHORTMESSAGE0 -> Security error
  • L_LONGMESSAGE0 -> Security header is not valid
  • L_SEVERITYCODE0 -> Error
  • PayPal returned error
« Back


Hi, in the Settings, make sure the "Sandbox Mode" (tests) is set to Inactive.

I had the same issue and after doing that everything worked perfectly.

I hope this helps! :)