Closed Bug 631400 Opened 15 years ago Closed 15 years ago

Donate Generating Fatal error on Credit Card Submission Page

Categories

(Websites :: donate.mozilla.org, defect)

Product:
Websites
Component:
donate.mozilla.org
Type:
defect
Priority:
Not set
Severity:
blocker

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: mcoates, Unassigned)

References

(
URL
)

Details

(Whiteboard: [infrasec:error][ws:low])

The donate.mozilla.org page is generating a fatal error whenever a user attempts to submit the donation form. From the error message this could be caused by a missing CSS file (http://mozilla.org/style/enhanced.css). This also points out a dangerous practice of trying to open a file over HTTP and then redisplay this content of HTTPS. This issue is a blocker because this site accepts credit card data. This issue needs to be investigated immediately to determine the root cause of the issue and whether credit card data could be at risk. Steps to Reproduce: 1. Go to http://www.mozilla.org/parks/tumucumaque/ 2. Click "Make A Donation Now" which redirects to https://donate.mozilla.org/page/contribute/tumucumaque 3. Enter any data (not necessarily valid) and push "Process Contribution" Error Message: Fatal error: Uncaught exception 'Framework_Contribution_CdeResponse_Exception' with message 'Could not decode JSON. Raw response: file_get_contents(http://mozilla.org/style/enhanced.css) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found #0 [internal function]: api_error_handler('http://mozilla....') #1 /home/bsdrelease/framework/3.10.1/htdocs/ui/layout_parser.class.php(1040): file_get_contents('http://mozilla....') #2 /home/bsdrelease/framework/3.10.1/htdocs/ui/layout_parser.class.php(1035): layout_parser->_file_get_contents(Array) #3 [internal function]: layout_parser->replaceImportsCss('/\<link .*?href...', Array, '<!DOCTYPE html>...') #4 /home/bsdrelease/framework/3.10.1/htdocs/ui/layout_parser.class.php(993): preg_replace_callback('<!DOCTYPE html>...', 'http://mozilla....') #5 /home/bsdrelease/framework/3.10.1/app/lib/Framework/Contribution/UiPage.php(34): layout_parser->proxifyURLs('<!DOCTYPE html>...') #6 /home/bsdrelease/fra in /var/www/app/lib/Framework/Contribution/CdeResponse/Factory.php on line 19 Fatal error: Exception thrown without a stack frame in Unknown on line 0
This is a blue state digital page.
I have reached out to my contact at BSD to get a resolution. Will update as soon as I hear back.
Bug filed with BSD. Just so I understand better Michael, this isn't a result of mixed content warning? We had an issue in the past where the header and footer resources were referencing other domains. We uploaded all the resources to donate.mozilla.org.
Update from BSD. They were able to replicate the bug and have their engineers on it. Will update as I get more information.
Update from BSD. 1) The (wrapper_id=2) specifies http://mozilla.org/style/enhanced.css as a css file, this file does not exist and because it's being specified as served via non secure http the BSD smartproxy tries to proxy it to prevent mixed secure/insecure content warning. This results in smartproxy throwing an error which then makes the API call of the contribution page unparseable. We are fixing this issue in the wrapper. 2) We have asked BSD to turn off error reporting so that the error above isn't exposed. I will update when they have done that. 3) We will be talking to BSD about their use of the smartproxy and the security risk it presents.
So a few issues here: 1) The immediate problem can be solved by us removing a reference to the file that is 404'ing. 2) We'll instruct BSD to at a minimum turn off error reporting. Users should never, ever see that stacktrace. 3) This obviously exposes a rather dubious practice on BSDs side (downloading files over HTTP, trusting them implicitly and re-serving over HTTPS). I'll go through and make sure that all resources use HTTPS, but obviously we'll want to take this practice in consideration when talking to BSD about their security practices. I'll endeavor to at least go through and at least remove the resources that 404 today.
Removed enhanced.css from two of the donations pages I found it in. That at least addresses the direct problem. Will revisit next week.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
Whiteboard: [infrasec:error][ws:low]
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.