diff options
| author | Lukas Fleischer <archlinux@cryptocrack.de> | 2011-08-11 17:35:03 +0200 |
|---|---|---|
| committer | Lukas Fleischer <archlinux@cryptocrack.de> | 2011-08-11 21:04:38 +0200 |
| commit | 1c9db1d1f14d5f83d8bd7dbbd535cf109680471f (patch) | |
| tree | f0d43b6b7364deed54fb8317e7d8b0ffb52ed5a0 /web/lib | |
| parent | a47f4915dcc057b8b57130886e009db9ca6afd44 (diff) | |
| download | aurweb-1c9db1d1f14d5f83d8bd7dbbd535cf109680471f.tar.xz | |
Add a configuration setting to disallow HTTP login
If this is enabled, do not show the login form and display a note
suggesting to switch to a secure connection if a user accesses the site
via HTTP.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'web/lib')
| -rw-r--r-- | web/lib/aur.inc.php | 7 | ||||
| -rw-r--r-- | web/lib/config.inc.php.proto | 3 |
2 files changed, 8 insertions, 2 deletions
diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 0927604..474ebee 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -326,9 +326,12 @@ function html_header($title="") { global $_POST; global $LANG; global $SUPPORTED_LANGS; + global $DISABLE_HTTP_LOGIN; - $login = try_login(); - $login_error = $login['error']; + if (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { + $login = try_login(); + $login_error = $login['error']; + } $title = htmlspecialchars($title, ENT_QUOTES); diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index f710844..0f672ab 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -71,3 +71,6 @@ $PERSISTENT_COOKIE_TIMEOUT = 60 * 60 * 24 * 30; # please ensure "upload_max_filesize" is additionally set to no more than 3M, # otherwise this check might be easy to bypass (FS#22991 for details) $MAX_FILESIZE_UNCOMPRESSED = 1024 * 1024 * 8; + +# Allow HTTPs logins only +$DISABLE_HTTP_LOGIN = true; |