[NOT A BUG] /whmcs/domainlookup.php submits form without SSL encryption

[epretorious]

Even if /whmcs/domainlookup.php is served using HTTPS, two of the six forms on the page submit the form without using HTTPS:

 

...
<div id="incart" align="center" style="display: none" >Choose Domain:
<form method="post" [color="#00FF00"]action="https://www.rocket-powered.com/whmcs/cart.php?a=add&domain=register[/color]">
<input type="hidden" name="domainoption" value="incart" />
...
<div id="owndomain" align="center" style="display: none" >
<form method="post" [color="#00FF00"]action="https://www.rocket-powered.com/whmcs/cart.php?a=add&domain=register[/color]">
<input type="hidden" name="domainoption" value="owndomain" />
...
<div id="subdomain" align="center" style="display: none" >
<form method="post" [color="#00FF00"]action="https://www.rocket-powered.com/whmcs/cart.php?a=add&domain=register[/color]">
<input type="hidden" name="domainoption" value="subdomain" />
...
<div id="register">
<form method="post" [color="#FF0000"]action="domainlookup.php"[/color]>
<input type="hidden" name="domainoption" value="register" />
...
<div id="transfer">
<form method="post" [color="#FF0000"]action="domainlookup.php"[/color]>
<input type="hidden" name="domainoption" value="transfer" />
...
<div id="results" >
<form method="post" [color="#00FF00"]action="https://www.rocket-powered.com/whmcs/cart.php?a=add&domain=register[/color]">
<input type="hidden" name="domainoption" value=register />
...

This causes Firefox to complain...

 

Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.

Please fix this.

Edited April 10, 2013 by epretorious

[epretorious]

Please report bugs to help@opensrs.com as domainlookup.php is a file we install with our module, not WHMCS.

 

Thanks, Mike. I didn't realize that /whmcs/domainlookup.php is installed by OpenSRS Domain Pro. I've sent an e-mail to help@opensrs.com.

Edited April 10, 2013 by epretorious