All forms under https page should be secured, but the flow code snippet on securepages.module line 111 will cause forms' action attribute on a mismatched secure page point to a unsecured location:

  elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE)) {
    $url['https'] = FALSE;
    $url['absolute'] = TRUE;
    $form['#action'] = url($url['path'], $url);
  }

  // Check to see if this form needs to be secured.
  $secure_form = securepages_match_form($form_id, $form_state['build_info']['args']);
  if (!$is_https && $secure_form) {
    $form['#https'] = TRUE;
  }

The fix is simple, just change this snippet to the follow, which force all forms on a secure page to be secured:

  elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE)) {
    $url['https'] = FALSE;
    $url['absolute'] = TRUE;
    $form['#action'] = url($url['path'], $url);
  }

  // Check to see if this form needs to be secured.
  $secure_form = securepages_match_form($form_id, $form_state['build_info']['args']);
  if ($secure_form) {
    $form['#https'] = TRUE;
  }

Patch attached.

CommentFileSizeAuthor
0001-Fix-non-secure-form-on-a-secure-page.patch988 bytesweynhamz

Comments

minoroffense’s picture

minoroffense commented

I was having a similar issue. But do you have

$conf['https'] = TRUE;

set in your settings.php file?

Or you can try variable_set('https', TRUE); or drush vset https 1 and try again?

Drupal's form.inc will only flip the form action to but an absolute path (with https) if that variable is set as well has having the $form['#https'] = TRUE;

See form.inc

  if (isset($element['#type']) && $element['#type'] == 'form') {
    if (!empty($element['#https']) && variable_get('https', FALSE) &&
        !url_is_external($element['#action'])) {
      global $base_root;
      // Not an external URL so ensure that it is secure.
      $element['#action'] = str_replace('http://', 'https://', $base_root) . $element['#action'];
    }
astonvictor’s picture

astonvictor commented
Status: Active » Closed (outdated)

D7 reached its EOL back in January 2025, and there is no active release for D7 for this module anymore.
Development or support is not planned for D7. All D7-related issues are marked as outdated in a bunch.

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.