Patch: support force_login_ssl properly

[derekp]

This patch fixes the Request::url(...) function to generate HTTPS URLs where required. Without this patch, resources (the login controller in particular) are not adequately protected by SSL. With force_login_ssl=On in config.inc.php, users would transmit their credentials over plaintext HTTP before being redirected to HTTPS.

This is not an elegant patch, since it hard-codes special cases into a generic function, but it is an effective solution.

Code: Select all

--- ocs-2.0.0-1/classes/core/Request.inc.php.forcessl   2007-04-10 13:45:06.000000000 -0700
+++ ocs-2.0.0-1/classes/core/Request.inc.php    2008-03-18 11:48:55.793930000 -0700
@@ -715,5 +715,10 @@
                }

-               return ((empty($overriddenBaseUrl)?Request::getIndexUrl():$overriddenBaseUrl) . $baseParams . $pathString . $additionalParams . $anchor);
+               $url = ((empty($overriddenBaseUrl)?Request::getIndexUrl():$overriddenBaseUrl) . $baseParams . $pathString . $additionalParams . $anchor);
+               if ( ($page == 'login' && $op == 'signIn' && Config::getVar('security', 'force_login_ssl')) ||
+                    Config::getVar('security', 'force_ssl') ) {
+                       $url = preg_replace('/^http:/', 'https:', $url);
+               }
+               return $url;
        }
 }