From 1c9db1d1f14d5f83d8bd7dbbd535cf109680471f Mon Sep 17 00:00:00 2001
From: Lukas Fleischer <archlinux@cryptocrack.de>
Date: Thu, 11 Aug 2011 17:35:03 +0200
Subject: Add a configuration setting to disallow HTTP login

If this is enabled, do not show the login form and display a note
suggesting to switch to a secure connection if a user accesses the site
via HTTP.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
---
 web/template/login_form.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'web/template')

diff --git a/web/template/login_form.php b/web/template/login_form.php
index ca81e0e7..b351a27e 100644
--- a/web/template/login_form.php
+++ b/web/template/login_form.php
@@ -6,7 +6,7 @@ if (isset($_COOKIE["AURSID"])) {
  <a href="logout.php">[<?php print __("Logout"); ?>]</a>
 <?php
 }
-else {
+elseif (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) {
 	if ($login_error) {
 		print "<span class='error'>" . $login_error . "</span><br />\n";
 	}
@@ -26,5 +26,13 @@ else {
 	<a href="passreset.php">[<?php echo __('Forgot Password') ?>]</a>
 	</div>
 </form>
+<?php
+}
+else {
+?>
+<span class='error'>
+	<?php echo __("HTTP login is disabled. Please switch to HTTPs if you want to login: "); ?>
+	<a href="https://aur.archlinux.org/">https://aur.archlinux.org/</a>
+</span>
 <?php } ?>
 </div>
-- 
cgit v1.2.3-24-g4f1b