From 0aeaae0427e053b67bd65bf0131de9d562744514 Mon Sep 17 00:00:00 2001
From: Reed Loden <reed@reedloden.com>
Date: Wed, 29 Sep 2010 11:51:47 -0700
Subject: Bug 600475 - Support the 'includeSubDomains' flag as an option for
 the 'Strict-Transport-Security' advanced option in order to protect
 subdomains. [r=glob a=mkanat]

---
 Bugzilla/CGI.pm             | 8 ++++++--
 Bugzilla/Config/Advanced.pm | 6 ++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

(limited to 'Bugzilla')

diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm
index de92cda99..054ba96a0 100644
--- a/Bugzilla/CGI.pm
+++ b/Bugzilla/CGI.pm
@@ -276,8 +276,12 @@ sub header {
 
     # Add Strict-Transport-Security (STS) header if this response
     # is over SSL and the strict_transport_security param is turned on.
-    if ($self->https && Bugzilla->params->{'strict_transport_security'}) {
-        unshift(@_, '-strict-transport-security' => 'max-age=' . MAX_STS_AGE);
+    if ($self->https && Bugzilla->params->{'strict_transport_security'} ne 'off') {
+        my $sts_opts = 'max-age=' . MAX_STS_AGE;
+        if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
+            $sts_opts .= '; includeSubDomains';
+        }
+        unshift(@_, '-strict_transport_security' => $sts_opts);
     }
 
     return $self->SUPER::header(@_) || "";
diff --git a/Bugzilla/Config/Advanced.pm b/Bugzilla/Config/Advanced.pm
index e15a42963..fada813f1 100644
--- a/Bugzilla/Config/Advanced.pm
+++ b/Bugzilla/Config/Advanced.pm
@@ -55,8 +55,10 @@ use constant get_param_list => (
 
   {
    name => 'strict_transport_security',
-   type => 'b',
-   default => 0,
+   type => 's',
+   choices => ['off', 'this_domain_only', 'include_subdomains'],
+   default => 'off',
+   checker => \&check_multi
   },
 );
 
-- 
cgit v1.2.3-24-g4f1b