From a7e7ed0f3a1d29800187a216b0363e0276d2f4ec Mon Sep 17 00:00:00 2001
From: "dkl%redhat.com" <>
Date: Thu, 10 Jul 2008 09:56:11 +0000
Subject: Bug 428659 – Setting SSL param to 'authenticated sessions' only
 protects logins and param doesn't protect WebService calls at all Patch by
 Dave Lawrence <dkl@redhat.com> - r/a=mkanat
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Bugzilla/WebService.pm | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'Bugzilla/WebService.pm')

diff --git a/Bugzilla/WebService.pm b/Bugzilla/WebService.pm
index 7812a237b..13e32c9d7 100755
--- a/Bugzilla/WebService.pm
+++ b/Bugzilla/WebService.pm
@@ -19,6 +19,7 @@ package Bugzilla::WebService;
 
 use strict;
 use Bugzilla::WebService::Constants;
+use Bugzilla::Util;
 use Date::Parse;
 use XMLRPC::Lite;
 
@@ -54,6 +55,15 @@ sub handle_login {
     return;
 }
 
+sub handle_redirect {
+    my ($action, $uri, $method) = @_;
+    my $full_method = $uri . "." . $method;
+
+    # Redirect to SSL if required.
+    Bugzilla->cgi->require_https(Bugzilla->params->{'sslbase'})
+        if ssl_require_redirect($full_method);
+}
+
 # For some methods, we shouldn't call Bugzilla->login before we call them
 use constant LOGIN_EXEMPT => { };
 
-- 
cgit v1.2.3-24-g4f1b