Bug 428659 – Setting SSL param to 'authenticated sessions' only protects logins and param doesn't protect WebService calls at all

Patch by Dave Lawrence <dkl@redhat.com> - r/a=mkanat

1 files changed, 3 insertions, 5 deletions

diff --git a/token.cgi b/token.cgi
index c91c2f94f..71996bec0 100755
--- a/token.cgi
+++ b/token.cgi
@@ -347,11 +347,9 @@ sub request_create_account {
     $vars->{'date'} = str2time($date);
 
     # We require a HTTPS connection if possible.
-    if (Bugzilla->params->{'sslbase'} ne ''
-        && Bugzilla->params->{'ssl'} ne 'never')
-    {
-        $cgi->require_https(Bugzilla->params->{'sslbase'});
-    }
+    Bugzilla->cgi->require_https(Bugzilla->params->{'sslbase'}) 
+        if ssl_require_redirect();
+
     print $cgi->header();
 
     $template->process('account/email/confirm-new.html.tmpl', $vars)