From 0aeaae0427e053b67bd65bf0131de9d562744514 Mon Sep 17 00:00:00 2001
From: Reed Loden <reed@reedloden.com>
Date: Wed, 29 Sep 2010 11:51:47 -0700
Subject: Bug 600475 - Support the 'includeSubDomains' flag as an option for
 the 'Strict-Transport-Security' advanced option in order to protect
 subdomains. [r=glob a=mkanat]

---
 template/en/default/admin/params/advanced.html.tmpl | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'template/en/default/admin')

diff --git a/template/en/default/admin/params/advanced.html.tmpl b/template/en/default/admin/params/advanced.html.tmpl
index 10a1fb678..a8e8a297b 100644
--- a/template/en/default/admin/params/advanced.html.tmpl
+++ b/template/en/default/admin/params/advanced.html.tmpl
@@ -35,6 +35,22 @@
   on its domain (i.e., your <code>urlbase</code> is something like
   <code>http://bugzilla.example.com/</code>), and you never plan to disable
   the <code>ssl_redirect</code> parameter.
+  <ul>
+    <li>
+      off - Don't send the Strict-Transport-Security header with requests.
+    </li>
+    <li>
+      this_domain_only - Send the Strict-Transport-Security header with all
+      requests, but only support it for the current domain.
+    </li>
+    <li>
+      include_subdomains - Send the Strict-Transport-Security header along
+      with the <code>includeSubDomains</code> flag, which will apply the
+      security change to all subdomains. This is especially useful when
+      combined with an <code>attachment_base</code> that exists as (a)
+      subdomain(s) under the main [% terms.Bugzilla %] domain.
+    </li>
+  </ul>
 [% END %]
 
 [% param_descs = {
-- 
cgit v1.2.3-24-g4f1b