58329 - On a series of https pages, padlock symbol often wrong and "You have requested (in)secure page" dialog gets the wrong one

Status: VERIFIED DUPLICATE of bug 53866

(Core Graveyard :: Security: UI, defect, P3)

Description

[hobbit]

Installed latest nightly: Mozilla/5.0 (X11; U; Linux 2.2.16-22 i586; en-US; m18
Gecko/20001027) according to "about:"

Installed PSM.

Went through most of the smoke-tests mentioned on the PSM page as I'm one of the
people bitten by http://bugzilla.mozilla.org/show_bug.cgi?id=34834
All was fine (woo!)

Went to http:/www.tesco.co.uk and clicked "Groceries to your door" which takes
you to http://www.tesco.com/Register/default.htm?from=/superstore/mainstore.asp
Went to register. Clicked "Register" :) This throws up "You have requested a
secure document" dialogue box and and took me to

https://secure.tesco.com/register/form_1.htm

which is where the fun starts.

This is the first in a series of https pages for this registration thing.
There are several 'help' buttons for things like your postcode and clubcard
number scattered over the pages which are javascript. On this first page, I
clicked the postcode "Help" button and:

o first, I got a "You have requested an insecure document" warning. I hit 'OK'
No javascript window occurred yet.

o then, I got a -second- security warning, now telling me "you have requested
a secure document". Whilst this was displayed, the main browser window had
lost its original "Tesco.Com - Registration Form 1 - Mozilla" titlebar and
said simply "Mozilla". I clicked "OK" for this anyway, The "Why we need to
know your postcode" javascript window arrived, the main window titlebar went
back to its original state and I suddenly realised that the padlock on the
main window was now open although I was still on an https page.

On filling in the details on that page and clocking 'Next', which should take
you to another secure https page, I was told, "You have requested an insecure
document". I clicked OK and went to https://secure.tesco.com/register/form_2.htm
which is apparently a secure page.

Matters continued like this. I did notice that when towards the end I clicked
back, back, back, back, ending up on the first page again, the little padlock
worked and was closed for them all. But as soon as I tried to go forward, it
opened up again.

I have got it (and me!) getting much more confused than that, but that's the
gist. I think it starts when you start clicking on the 'Help' buttons. It's
been suggested that it's to do with "mixed content on the web page", if that
helps.

If you need a UK postcode to get anywhere with this, they're of the format
"letter letter digit space digit letter letter". You get a choice of addresses
from that postcode then. Phone numbers are O1xxx xxxxxxx where the x can be
pretty much any number.

Comment 1

[John Unruh]

Making bug 31344 dependent on this bug.

Comment 2

[Azrael AOD]

Is this related to bug 52795 at all?

Comment 3

[Mike Jaques]

Dupe of Bug 53866 - lock related.

Comment 4

[Azrael AOD]

Good spot Mike!
Agreeing that this is a duplicate of Bug 53866 and marking it as such.
'Lock icon is temporarily unlocked between HTTPS pages'

*** This bug has been marked as a duplicate of 53866 ***

Comment 5

[John Unruh]

Verified dupe.