On a site, I'm having problems with update.php and would appreciate some guidance.

The secure pages settings are currently "Make secure every page except the listed pages." with these pages listed:

  • batch*
  • batch/*
  • authorize.php*
  • update.php*

When I go to update.php, the page comes up in https mode but the CSS and JS files associated with it are not loading. The browser (in the webconsole) reports "Blocked loading mixed active content" for each CSS and JS file.

A technician at the hosting company tells me that mod_rewrite isn't enabled.

Should update.php run in http or https mode?
Do the secure pages settings look right? (Everything seen by users beyond the front page should be secure; it could be too for that matter.)
Is mod_rewrite required to make this work?

Can you suggest anything else that might be set incorrectly, and might cause this?

Comments

kenorb’s picture

kenorb commented
Status: Active » Fixed

Secure Pages doesn't secure pages other than what is servered by index.php

See: https://www.drupal.org/node/174839#comment-680668

So your configuration is invalid. Pages update.php and authorize.php should be removed and it won't work like you're expecting. These pages don't need to be in https, it's your settings file saying if these pages should be secured by external access or not. If you need https, then use https for update.php, simple. If you want to force https, you need to use mod_rewrite rules. And I believe your Apache has mod_rewrite already enabled, because Drupal is requiring it by default, so it's a matter of proper configuration.

You can also remove batch/* and to avoid any further headaches, because the list doesn't end up on batch (there are plenty of other addresses such as node/*/edit, user/*/edit, etc), just select administrator role in the User roles, so you'll always use https for all admin pages.

See also: #1504486: Can't force https on authorize.php (gives AJAX error)

ailgm’s picture

ailgm commented

Thank you for the assistance.

I've made the changes suggested to the secure pages configuration and commented out two lines in settings.php (for $base_url and $conf('https')). It all seems to work now.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.