All forms under https page should be secured, but the flow code snippet on securepages.module line 111 will cause forms' action attribute on a mismatched secure page point to a unsecured location:

  elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE)) {
    $url['https'] = FALSE;
    $url['absolute'] = TRUE;
    $form['#action'] = url($url['path'], $url);
  }

  // Check to see if this form needs to be secured.
  $secure_form = securepages_match_form($form_id, $form_state['build_info']['args']);
  if (!$is_https && $secure_form) {
    $form['#https'] = TRUE;
  }

The fix is simple, just change this snippet to the follow, which force all forms on a secure page to be secured:

  elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE)) {
    $url['https'] = FALSE;
    $url['absolute'] = TRUE;
    $form['#action'] = url($url['path'], $url);
  }

  // Check to see if this form needs to be secured.
  $secure_form = securepages_match_form($form_id, $form_state['build_info']['args']);
  if ($secure_form) {
    $form['#https'] = TRUE;
  }

Patch attached.

CommentFileSizeAuthor
0001-Fix-non-secure-form-on-a-secure-page.patch988 bytesweynhamz
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

minorOffense’s picture

minorOffense CreditAttribution: minorOffense at Coldfront Labs Inc. commented

I was having a similar issue. But do you have

$conf['https'] = TRUE;

set in your settings.php file?

Or you can try variable_set('https', TRUE); or drush vset https 1 and try again?

Drupal's form.inc will only flip the form action to but an absolute path (with https) if that variable is set as well has having the $form['#https'] = TRUE;

See form.inc

  if (isset($element['#type']) && $element['#type'] == 'form') {
    if (!empty($element['#https']) && variable_get('https', FALSE) &&
        !url_is_external($element['#action'])) {
      global $base_root;
      // Not an external URL so ensure that it is secure.
      $element['#action'] = str_replace('http://', 'https://', $base_root) . $element['#action'];
    }