IS SSL Issues - Buddypress S2 Pro - BP-click Theme

[psound]

I am using S2Member Pro with Buddypress and have SSL activated on my sign-up pages. I am using BP-Slick as my theme

Two issues with Internet Explorer. First is the “Internet Explorer blocked this website from displaying content with security certificate errors”. This is annoying and presents a problem for users, but even worse:

IE does not keep users logged in on the SSL pages. That makes it impossible for my free subscribers to upgrade to paid membership via IE.

Site is here:

http://spiritualnotreligious.net/

Free membership page is here (and an easy place to see the security errors).
https://spiritualnotreligious.net/membe ... embership/

Any assistance in getting S2Member, BP-Slick and IE to play nice?

[Jason Caldwell]

Thanks for reporting these important issues.

First is the “Internet Explorer blocked this website from displaying content with security certificate errors”. This is annoying and presents a problem for users, but even worse:

When you set the Custom Field ( s2member_force_ssl = yes ), s2Member will force all embedded media to the https protocol to ensure these errors do not occur. However, depending on your theme, and other plugins that you're running, you could still have the type of errors you're seeing. This happens whenever some of your embedded media is stored on servers that do not support the https protocol. Or in your case, when one of the servers contains an invalid SSL certificate. Upon visiting your site in Firefox, I find this server does not have a valid SSL certificate, and this is why you're seeing this reported in Internet Explorer. https://cdn.jquerytools.org/1.1.2/full/ ... ?ver=1.3.2

Taken out of context. Here is the code snippet in your site's source code:

Code: Select all

<script type='text/javascript' src='https://cdn.jquerytools.org/1.1.2/full/jquery.tools.min.js?ver=1.3.2'></script>

---

IE does not keep users logged in on the SSL pages. That makes it impossible for my free subscribers to upgrade to paid membership via IE.

I'm sorry, I've been unable to reproduce this under normal circumstances. The only case in which I'm aware of this possibility, is when a User/Member logs in through the SSL-enabled version of your site. So for instance, if you have a login form that points to `https://yoursite/wp-login.php` instead of `http://yoursite/wp-login.php`, WordPress will automatically force the authentication cookies to be valid ONLY on the SSL-enabled version of your site. This is a built-in WP security measure.

However, this only happens when a User/Member logs in on the SSL variation of your site, and does NOT happen when a Customer logs in on the non-SSL variation. In other words, if a User/Member logs in on the non-SSL variation of your site ( which is the most typical/recommended way ), they will be recognized on both the SSL and non-SSL variations. So, the way to work around this potential issue, is to make sure all of your login forms are using the non-SSL variation; or to make your entire site accessible via SSL instead of a selected set of pages. Since SSL encryption consumes a larger amount of server resources, and is usually required only for checkout forms, I recommend pointing all of your login forms to the non-SSL variation of your site. For example: `http://yoursite/wp-login.php`.

Another workaround, is to tell WordPress® to always recognize Users/Members on both variations of your site; regardless of whether they logged in on the SSL or non-SSL variations. This can be accomplished by Filtering the built-in WordPress handling of this scenario.

Create this directory and file:
/wp-content/mu-plugins/wp-hacks.php

Inside the file, do something like this:

Code: Select all

<?php
add_filter("secure_auth_cookie", "__return_false");
add_filter("secure_logged_in_cookie", "__return_false");
?>

If you continue to have trouble with this, please email us an administrative Dashboard login and we'll test the functionality of your login form; just in case we've completely missed something in your bug report.

[Jason Caldwell]

RELATED TOPIC:
www vs. links without www
viewtopic.php?f=36&t=1066

[psound]

Thanks for the response!

I went ahead and fixed the first issue by self-hosting the file in question.

I am having serious issues with IE9 on my site. When trying to sign-up, IE 9 actually crashes:

Visit: https://spiritualnotreligious.net/membe ... s2-ssl=yes

and clicking on the Mastercard button causes IE to crash with error details:
Problem Event Name: BEX
Application Name: iexplore.exe
Application Version: 9.0.8080.16413
Application Timestamp: 4d4ceeab
Fault Module Name: StackHash_798f
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: 656c6573
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.1.7600.2.0.0.256.1

[psound]

FYI, IE 8 works fine including going from http:// to https://

I am going to do some more testing with IE 9 and let you know if there is anything worth reporting.

[psound]

OK. I removed IE 9.

Tested everything in IE 8 and it works like a charm.

Reloaded IE 9. Going from http:// to https:// works great now.

However when I go to the sign up page (https://spiritualnotreligious.net/membe ... s2-ssl=yes
) and click on the Mastercard button I get this:

"Internet Explorer has closed this webpage to help protect your computer"
"A malfunctioning or malicious add-on has caused Internet Explorer to close this webpage."

res://ieframe.dll/acr_depnx_error.htm#s ... s2-ssl=yes

Under More Information:
"Windows Data Execution Prevention detected an add-on trying to use system memory incorrectly. This can be caused by a malfunction or a malicious add-on.

Other things you can do:

Go online to learn about the Data Execution Prevention (DEP) security feature"

[Jason Caldwell]

Thanks for reporting this important issue.

However when I go to the sign up page (https://spiritualnotreligious.net/membe ... s2-ssl=yes
) and click on the Mastercard button I get this:

"Internet Explorer has closed this webpage to help protect your computer"
"A malfunctioning or malicious add-on has caused Internet Explorer to close this webpage."

I just tested your site in IE9 with the latest build. IE9 v9.0.8112.16421. I've been unable to reproduce this error running the latest build on Windows® Vista with no add-ons. Please try this latest build and if you still have this problem, please let me know what ( if any ) toolbars, add-ons you're running together with IE. The bug you're describing sounds like it could have something to do with an add-on for IE.

Problem Event Name: BEX=Buffer overflow exception.

* See: http://www.google.com/search?q=ie9+BEX+error

[psound]

Thanks for the assistance Jason!

I have not been able to duplicate the problem again. Transactions appear to be going through smoothly again.

On a side note: Does Primo Themes have a BuddyPress theme? s2Member and BuddyPress are a potent combo and I would love to switch to one of your themes (I appreciate the quality of your work and the detailed support available).

Cheers!
Michael

[psound]

OK. I spoke too soon.

Another user reported issue with IE 9, that I have duplicated.

Go to a registration page, select one of the credit card options, select Submit Form and nothing happens.

https://spiritualnotreligious.net/membe ... s2-ssl=yes

You can test this without filling out any data. In Firefox a pop-up is displayed showing missing fields. In IE 9, absolutely nothing happens.

[Jason Caldwell]

Taking another look at this now.
~ It seems sporadic/unpredictable; but I was able to reproduce a crash this time.
Looking for a possible resolution.

20% resolved

[Jason Caldwell]

I'm going to leave this investigation open for now, because I'm not 100% sure where this bug originates yet. However, I've been unable to reproduce this in our development environment and on demo installations. While we continue to investigate this, here are some things I could use your help on.

1. Can you please make an attempt to reproduce this bug with our demo?
http://dev.primothemes.com/s2clean/payp ... kout-demo/
( the issue you're reporting seems to happen only on your site )

2. I see you're running WP 3.1, yet the version of jQuery that your theme is using is v1.3.2. WordPress 3.1 comes with jQuery v1.4.4 and this could very well be the source of the issue, as I suspect the jQuery team has made changes in recent versions to accommodate IE9. So I suggest updating your theme so it's using the latest version of the jQuery framework. This was taken from the source code of your site:

Code: Select all

<script type='text/javascript' src='https://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js?ver=1.3.2'></script>
<script type='text/javascript' src='https://spiritualnotreligious.net/js/jquery.tools.min.js?ver=1.3.2'></script>

* Let's try this to see if we can eliminate jQuery v1.3.2 as being the culprit.

I've run tests here with jQuery v1.3.2 and everything works fine on our end. However, it could be that your theme is calling upon jQuery functions intertwined with s2Member routines; culminating in some special IE9 cocktail. jQuery v1.4.4 may correct this for you.

35% resolved

[psound]

OK... it does not look to be jquery.

I put up this test page with nothing else but the shortcode, and it works OK:

https://spiritualnotreligious.net/month ... s2-ssl=yes


I am going to go through my HTML and see if I can figure out what is going on.

[psound]

FYI...

I had copy and pasted the "Yes I want to receive emails" text at the bottom of each signup page and a

Code: Select all

 

was on all the impacted pages. Removing that seemed to fix the issue.

100% resolved ( still looking for possible bug fix though )

@TODO :: investigate this further.

[Jason Caldwell]

Ah. Nice work. I just tested and it seems to have done the trick.
Can you please post the exact code ( full version ) you had in there when this was a problem? I'd like to reproduce this on our end and see if we can make adjustments to prevent this from happening.

[psound]

Here is what I had on the page.

Code: Select all

Premium Subscription gets you exclusive access to Weekly Empowerment  Messages, including updates messages every Monday from the Sunday  service at Center for Spiritual Living Seattle.  Includes:
<ul>
   <li>New Weekly Empowerment Message uploaded every Monday</li>
   <li>High Quality video tailored to your broadband internet connection</li>
   <li>Full access to Spiritual Not Religious Weekly Empowerment Message archives</li>
   <li>Video Player compatible with mobile, including iPhone and iPad</li>
</ul>
Sign up for Monthly Access - $14.99 a month or <a title="Spiritual But Not Religious Yearly Membership" href="http://spiritualnotreligious.net/membership-signup/premier-yearly-membership/">click here for yearly access for $149.00</a>, a savings of over $30 per year!

[s2Member-Pro-PayPal-Form level="2" ccaps="" desc="$14.99 USD / Monthly ( recurring charge, for ongoing access )" ps="paypal" cc="USD" ns="1" custom="spiritualnotreligious.net" ta="0" tp="0" tt="D" ra="14.99" rp="1" rt="M" rr="1" accept="paypal,visa,mastercard,amex,discover,maestro,solo" accept_via_paypal="paypal" coupon="" accept_coupons="0" default_country_code="" captcha="0" /]
&nbsp;
<em>Please leave "Yes, I want to receive updates via email" checked if you wish to receive updates when the latest Weekly Empowerment Message has been uploaded.</em>
&nbsp;
<em>Billing note:  <a title="Spiritual But Not Religious Online Community" href="http://spiritualnotreligious.net">Spiritual But Not Religious Online Community</a> is presented by <a title="Center for Spiritual Living Seattle" href="http://spiritualliving.org">Center for Spiritual Living Seattle</a> in partnership with <a href="http://wootastic.org">Wootastic.org</a>.  Your payment will show as going to Wootastic.org, L.L.C. (for PayPal orders) and will appear on your credit card bill as SNR-WOOT.</em>
<p>&nbsp;</p>

I also went ahead and left a bad version of the page up as a test here: https://spiritualnotreligious.net/month ... s2-ssl=yes

[psound]

Here is another page that fails with IE9 (unable to submit form) and that works with Firefox.

In this case it fails when you are logged in as a level 0 (subscriber) member.

Code: Select all

[s2If current_user_is(s2member_level4)]
You are logged in as Level 4 - Dude! You are an admin!
[/s2If]

[s2If current_user_is(s2member_level3)]
Do we even have a Level 3 here?  If so, kudos!!  You must have full access!
[/s2If]

[s2If current_user_is(s2member_level2)]
You are a Premier member!  You have full access to the site, including our Audio and Video Weekly  Empowerment Message and Archives!  Woot!!

[/s2If]

[s2If current_user_is(s2member_level1)]
You are logged in as an  Audio level member!  That means you have access to our Audio archives  and the audio version of  the Weekly Empowerment Message.

If you are ready to see what  you have been hearing, <a title="Upgrade to Premier Monthly" href="http://spiritualnotreligious.net/membership-signup/upgrade/upgrade-to-premier-monthly/">click here</a> for to upgrade to Premier and get full access to our Video archives for only $14.99 per month, or <a title="Upgrade to Premier Yearly" href="http://spiritualnotreligious.net/membership-signup/upgrade/upgrade-to-premier-yearly/">click here</a> to go Yearly Premier  for only $149 a year (a savings of over $30 per year).

[/s2If]

[s2If current_user_is(s2member_level0)]
You are currently a free subscriber with access to the free Video of the Month and partial access to our discussion Forums.

Fill out the form below to upgrade to the Monthly Audio subscription for  only $14.99 a month, including access to the audio version of the Weekly  Empowerment Message!

[s2Member-Pro-PayPal-Form level="1" ccaps="" desc="$10.00 USD / Monthly ( recurring charge, for ongoing access )" ps="paypal" cc="USD" ns="1" custom="spiritualnotreligious.net" ta="0" tp="0" tt="D" ra="10.00" rp="1" rt="M" rr="1" modify="1" accept="paypal,visa,mastercard,amex,discover,maestro,solo" accept_via_paypal="paypal" coupon="" accept_coupons="0" default_country_code="" captcha="0" /]

[/s2If]

[s2If !current_user_can(access_s2member_level0)]
You  are not registered (or logged in) to Spiritual But Not Religious Online  Community.  Please visit our <a title="Membership Signup" href="http://spiritualnotreligious.net/membership-signup/">Membership Signup page</a> to view your  options.
[/s2If]

[Jason Caldwell]

Thanks for the follow-up.
I've was able to reproduce this on your site, but unable to reproduce it anywhere else.
I'm marking this resolved for now. If anyone else has this same issue, please report it. Thank you!

[bsowards]

On a side note: Does Primo Themes have a BuddyPress theme? s2Member and BuddyPress are a potent combo and I would love to switch to one of your themes (I appreciate the quality of your work and the detailed support available).

I'd also be interested in this.