CiviCRM Community Forums (archive)

Contact, Event Search - no autocomplete fields will work.

I see a Mixed Content warning, looks like a call back to the site is using http instead of https, but I don't know from where. All settings and config files reference https

I've tried disabling forced SSL as well as enforced a redirect from http to https. Makes no difference.
Site debugging turns up nothing - all I see in debug window for firebug, etc. is the mixed content warning.

Magic quotes are turned off.

Am at my wits end, as it means I cannot create event registrations and relationships on the backend of the site.

Joomla 2.5.28
Civi 4.5.8
PHP Version    5.4.32

Yup - went over those instructions with a fine tooth comb.

It looks like they render and don't fetch results. The spinner is visible, but nothing is found.

Can you give me nudge towards what log I'd check to see that server response? I have access to the server at root level, so I can pretty much get you whatever you want if I know where to find it.

Thanks, Coleman!

here's a screenshot of the network console that shows the ajax call.

I see 302 errors, which are redirects, but I have no redirects in place for the site.

I can send you the log from the crm.ajax.js call too if that's helpful

here's the console log:

https://soar.on.ca/administrator/ [HTTP/1.1 302 Found 86ms]
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] administrator
Blocked loading mixed active content "http://soar.on.ca/"[Learn More] index.php
GET
XHR
https://soar.on.ca/administrator/ [HTTP/1.1 302 Found 2201ms]
This site makes use of a SHA-1 Certificate; it's recommended you use certificates with signature algorithms that use hash functions stronger than SHA-1.[Learn More] administrator

And there's your answer: your site is https but the ajax call is happening over http, an your web browser is blocking it due to security (as it should).
Check your base url settings in Administer->System Settings->Directories and also $civicrm_root in civicrm.settings.php

Oddly enough, I have another 4.5.8 site on the same server, also with nonfunctional autocomplete fields.

I'm getting this console error for the autocomplete in Register an Event Participant.

jquery-1.11.1.min.js?r=IAk1t:4 Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check http://xhr.spec.whatwg.org/.

Contact search doesn't event display the spinner.

Nice job finding it.
If you find out more specifics about mod_security and how to configure it so it doesn't conflict with Civi, please let me know and I'll add it to the troubleshooting page.

Coleman - these are the rules we disabled and autocomplete started working as it should. It also fixed an issue whereby I could display the CiviEvent feed in a Joomla module position.

Here is the list of rules and their descriptions. These rules are all part of the free set from OWASP:

REQUEST-41-APPLICATION-ATTACK-SQLI
The configuration file path:
modsec_vendor_configs/OWASP/rules/REQUEST-41-APPLICATION-ATTACK-SQLI.conf

The rules in this configuration file enables protection against SQL injection attacks. During a SQL injection attack,  a client is able to pass a specially crafted HTTP request to the server. This HTTP request causes the server to mistakenly execute a malicious query.
REQUEST-43-APPLICATION-ATTACK-SESSION-FIXATION
The configuration file path:
modsec_vendor_configs/OWASP/rules/REQUEST-43-APPLICATION-ATTACK-SESSION-FIXATION.conf

The rules in this configuration file enable protection against Session Fixation attacks. During a Session Fixation attack, attackers to force a user's session ID to be predictable. With the session ID, the attacker can take over a session that belongs to another user.
REQUEST-49-BLOCKING-EVALUATION
The configuration file path:
modsec_vendor_configs/OWASP/rules/REQUEST-49-BLOCKING-EVALUATION.conf

The rules in this configuration file blocks traffic that various other configuration files request.

Warning:

Other rules in the rule set depend on this configuration file to block incoming attacks. If you disable this configuration file, other rules will detect, but not block, incoming attacks.