From 20d885c77680fc082640c0a7340be44cd02b2779 Mon Sep 17 00:00:00 2001 From: "dkl%redhat.com" <> Date: Mon, 18 Aug 2008 09:16:12 +0000 Subject: Bug 428659 – Setting SSL param to 'authenticated sessions' only protects logins and param doesn't protect WebService calls at all Patch by David Lawrence - r/a=LpSolit/mkanat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Bugzilla/Auth/Login/CGI.pm | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'Bugzilla/Auth') diff --git a/Bugzilla/Auth/Login/CGI.pm b/Bugzilla/Auth/Login/CGI.pm index 980e27123..9e008be82 100644 --- a/Bugzilla/Auth/Login/CGI.pm +++ b/Bugzilla/Auth/Login/CGI.pm @@ -65,12 +65,17 @@ sub fail_nodata { ->faultstring('Login Required'); } - # Redirect to SSL if required - if (Bugzilla->params->{'sslbase'} ne '' - and Bugzilla->params->{'ssl'} ne 'never') + # If system is not configured to never require SSL connections + # we want to always redirect to SSL since passing usernames and + # passwords over an unprotected connection is a bad idea. If we + # get here then a login form will be provided to the user so we + # want this to be protected if possible. + if ($cgi->protocol ne 'https' && Bugzilla->params->{'sslbase'} ne '' + && Bugzilla->params->{'ssl'} ne 'never') { $cgi->require_https(Bugzilla->params->{'sslbase'}); } + print $cgi->header(); $template->process("account/auth/login.html.tmpl", { 'target' => $cgi->url(-relative=>1) }) -- cgit v1.2.3-24-g4f1b