Fossil SCM

Enhance the "redirect-to-https" setting so that if it is 2 or more it forces all pages to travel of a secure connection.

drh 2019-01-21 18:28 trunk merge
Commit 4aba9ea6fe949ea9da204f13e9270ea353796d669fdb184cbb067e13b29b95d2
Parent 742d64d916facd8…
5 files changed +1 -1 +2 -41 +54 -2 +16 -8 +2 -2
~ src/cgi.c ~ src/login.c ~ src/main.c ~ src/setup.c ~ src/style.c
M src/cgi.c
+1 -1
--- src/cgi.c
+++ src/cgi.c
@@ -354,11 +354,11 @@
354354
 /*
355355
 ** Do a redirect request to the URL given in the argument.
356356
 **
357357
 ** The URL must be relative to the base of the fossil server.
358358
 */
359
-NORETURN static void cgi_redirect_with_status(
359
+NORETURN void cgi_redirect_with_status(
360360
 const char *zURL,
361361
 int iStat,
362362
 const char *zStat
363363
 ){
364364
 char *zLocation;
365365
--- src/cgi.c
+++ src/cgi.c
@@ -354,11 +354,11 @@
354 /*
355 ** Do a redirect request to the URL given in the argument.
356 **
357 ** The URL must be relative to the base of the fossil server.
358 */
359 NORETURN static void cgi_redirect_with_status(
360 const char *zURL,
361 int iStat,
362 const char *zStat
363 ){
364 char *zLocation;
365
--- src/cgi.c
+++ src/cgi.c
@@ -354,11 +354,11 @@
354 /*
355 ** Do a redirect request to the URL given in the argument.
356 **
357 ** The URL must be relative to the base of the fossil server.
358 */
359 NORETURN void cgi_redirect_with_status(
360 const char *zURL,
361 int iStat,
362 const char *zStat
363 ){
364 char *zLocation;
365
M src/login.c
+2 -41
--- src/login.c
+++ src/login.c
@@ -549,34 +549,11 @@
549549
 const char *zIpAddr; /* IP address of requestor */
550550
 const char *zReferer;
551551
 int noAnon = P("noanon")!=0;
552552
553553
 login_check_credentials();
554
- if( login_wants_https_redirect() ){
555
- const char *zQS = P("QUERY_STRING");
556
- if( P("redir")!=0 ){
557
- style_header("Insecure Connection");
558
- @ <h1>Unable To Establish An Encrypted Connection</h1>
559
- @ <p>This website requires that login credentials be sent over
560
- @ an encrypted connection. The current connection is not encrypted
561
- @ across the entire route between your browser and the server.
562
- @ An attempt was made to redirect to %h(g.zHttpsURL) but
563
- @ the connection is still insecure even after the redirect.</p>
564
- @ <p>This is probably some kind of configuration problem. Please
565
- @ contact your sysadmin.</p>
566
- @ <p>Sorry it did not work out.</p>
567
- style_footer();
568
- return;
569
- }
570
- if( zQS==0 ){
571
- zQS = "?redir=1";
572
- }else if( zQS[0]!=0 ){
573
- zQS = mprintf("?%s&redir=1", zQS);
574
- }
575
- cgi_redirectf("%s%T%s", g.zHttpsURL, P("PATH_INFO"), zQS);
576
- return;
577
- }
554
+ fossil_redirect_to_https_if_needed(1);
578555
 sqlite3_create_function(g.db, "constant_time_cmp", 2, SQLITE_UTF8, 0,
579556
 constant_time_cmp_function, 0, 0);
580557
 zUsername = P("u");
581558
 zPasswd = P("p");
582559
 anonFlag = g.zLogin==0 && PB("anon");
@@ -914,26 +891,10 @@
914891
 " AND constant_time_cmp(cookie,%Q)=0",
915892
 zLogin, zRemoteAddr, zCookie
916893
 );
917894
 return uid;
918895
 }
919
-
920
-/*
921
-** Return true if it is appropriate to redirect login requests to HTTPS.
922
-**
923
-** Redirect to https is appropriate if all of the above are true:
924
-** (1) The redirect-to-https flag is set
925
-** (2) The current connection is http, not https or ssh
926
-** (3) The sslNotAvailable flag is clear
927
-*/
928
-int login_wants_https_redirect(void){
929
- if( g.sslNotAvailable ) return 0;
930
- if( db_get_boolean("redirect-to-https",0)==0 ) return 0;
931
- if( P("HTTPS")!=0 ) return 0;
932
- return 1;
933
-}
934
-
935896
936897
 /*
937898
 ** Attempt to use Basic Authentication to establish the user. Return the
938899
 ** (non-zero) uid if successful. Return 0 if it does not work.
939900
 */
@@ -1461,11 +1422,11 @@
14611422
 {
14621423
 const char *zUrl = PD("REQUEST_URI", "index");
14631424
 const char *zQS = P("QUERY_STRING");
14641425
 Blob redir;
14651426
 blob_init(&redir, 0, 0);
1466
- if( login_wants_https_redirect() && !g.sslNotAvailable ){
1427
+ if( fossil_wants_https(1) ){
14671428
 blob_appendf(&redir, "%s/login?g=%T", g.zHttpsURL, zUrl);
14681429
 }else{
14691430
 blob_appendf(&redir, "%R/login?g=%T", zUrl);
14701431
 }
14711432
 if( anonOk ) blob_append(&redir, "&anon", 5);
14721433
--- src/login.c
+++ src/login.c
@@ -549,34 +549,11 @@
549 const char *zIpAddr; /* IP address of requestor */
550 const char *zReferer;
551 int noAnon = P("noanon")!=0;
552
553 login_check_credentials();
554 if( login_wants_https_redirect() ){
555 const char *zQS = P("QUERY_STRING");
556 if( P("redir")!=0 ){
557 style_header("Insecure Connection");
558 @ <h1>Unable To Establish An Encrypted Connection</h1>
559 @ <p>This website requires that login credentials be sent over
560 @ an encrypted connection. The current connection is not encrypted
561 @ across the entire route between your browser and the server.
562 @ An attempt was made to redirect to %h(g.zHttpsURL) but
563 @ the connection is still insecure even after the redirect.</p>
564 @ <p>This is probably some kind of configuration problem. Please
565 @ contact your sysadmin.</p>
566 @ <p>Sorry it did not work out.</p>
567 style_footer();
568 return;
569 }
570 if( zQS==0 ){
571 zQS = "?redir=1";
572 }else if( zQS[0]!=0 ){
573 zQS = mprintf("?%s&redir=1", zQS);
574 }
575 cgi_redirectf("%s%T%s", g.zHttpsURL, P("PATH_INFO"), zQS);
576 return;
577 }
578 sqlite3_create_function(g.db, "constant_time_cmp", 2, SQLITE_UTF8, 0,
579 constant_time_cmp_function, 0, 0);
580 zUsername = P("u");
581 zPasswd = P("p");
582 anonFlag = g.zLogin==0 && PB("anon");
@@ -914,26 +891,10 @@
914 " AND constant_time_cmp(cookie,%Q)=0",
915 zLogin, zRemoteAddr, zCookie
916 );
917 return uid;
918 }
919
920 /*
921 ** Return true if it is appropriate to redirect login requests to HTTPS.
922 **
923 ** Redirect to https is appropriate if all of the above are true:
924 ** (1) The redirect-to-https flag is set
925 ** (2) The current connection is http, not https or ssh
926 ** (3) The sslNotAvailable flag is clear
927 */
928 int login_wants_https_redirect(void){
929 if( g.sslNotAvailable ) return 0;
930 if( db_get_boolean("redirect-to-https",0)==0 ) return 0;
931 if( P("HTTPS")!=0 ) return 0;
932 return 1;
933 }
934
935
936 /*
937 ** Attempt to use Basic Authentication to establish the user. Return the
938 ** (non-zero) uid if successful. Return 0 if it does not work.
939 */
@@ -1461,11 +1422,11 @@
1461 {
1462 const char *zUrl = PD("REQUEST_URI", "index");
1463 const char *zQS = P("QUERY_STRING");
1464 Blob redir;
1465 blob_init(&redir, 0, 0);
1466 if( login_wants_https_redirect() && !g.sslNotAvailable ){
1467 blob_appendf(&redir, "%s/login?g=%T", g.zHttpsURL, zUrl);
1468 }else{
1469 blob_appendf(&redir, "%R/login?g=%T", zUrl);
1470 }
1471 if( anonOk ) blob_append(&redir, "&anon", 5);
1472
--- src/login.c
+++ src/login.c
@@ -549,34 +549,11 @@
549 const char *zIpAddr; /* IP address of requestor */
550 const char *zReferer;
551 int noAnon = P("noanon")!=0;
552
553 login_check_credentials();
554 fossil_redirect_to_https_if_needed(1);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
555 sqlite3_create_function(g.db, "constant_time_cmp", 2, SQLITE_UTF8, 0,
556 constant_time_cmp_function, 0, 0);
557 zUsername = P("u");
558 zPasswd = P("p");
559 anonFlag = g.zLogin==0 && PB("anon");
@@ -914,26 +891,10 @@
891 " AND constant_time_cmp(cookie,%Q)=0",
892 zLogin, zRemoteAddr, zCookie
893 );
894 return uid;
895 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
896
897 /*
898 ** Attempt to use Basic Authentication to establish the user. Return the
899 ** (non-zero) uid if successful. Return 0 if it does not work.
900 */
@@ -1461,11 +1422,11 @@
1422 {
1423 const char *zUrl = PD("REQUEST_URI", "index");
1424 const char *zQS = P("QUERY_STRING");
1425 Blob redir;
1426 blob_init(&redir, 0, 0);
1427 if( fossil_wants_https(1) ){
1428 blob_appendf(&redir, "%s/login?g=%T", g.zHttpsURL, zUrl);
1429 }else{
1430 blob_appendf(&redir, "%R/login?g=%T", zUrl);
1431 }
1432 if( anonOk ) blob_append(&redir, "&anon", 5);
1433
M src/main.c
+54 -2
--- src/main.c
+++ src/main.c
@@ -1334,10 +1334,60 @@
13341334
 }
13351335
 #endif
13361336
 db_panic_close();
13371337
 exit(1);
13381338
 }
1339
+
1340
+/*
1341
+** Return true if it is appropriate to redirect requests to HTTPS.
1342
+**
1343
+** Redirect to https is appropriate if all of the above are true:
1344
+** (1) The redirect-to-https flag has a valud of iLevel or greater.
1345
+** (2) The current connection is http, not https or ssh
1346
+** (3) The sslNotAvailable flag is clear
1347
+*/
1348
+int fossil_wants_https(int iLevel){
1349
+ if( g.sslNotAvailable ) return 0;
1350
+ if( db_get_int("redirect-to-https",0)<iLevel ) return 0;
1351
+ if( P("HTTPS")!=0 ) return 0;
1352
+ return 1;
1353
+}
1354
+
1355
+/*
1356
+** Redirect to the equivalent HTTPS request if the current connection is
1357
+** insecure and if the redirect-to-https flag greater than or equal to
1358
+** iLevel. iLevel is 1 for /login pages and 2 for every other page.
1359
+*/
1360
+int fossil_redirect_to_https_if_needed(int iLevel){
1361
+ if( fossil_wants_https(iLevel) ){
1362
+ const char *zQS = P("QUERY_STRING");
1363
+ char *zURL;
1364
+ if( P("redir")!=0 ){
1365
+ style_header("Insecure Connection");
1366
+ @ <h1>Unable To Establish An Encrypted Connection</h1>
1367
+ @ <p>This website requires an encrypted connection.
1368
+ @ The current connection is not encrypted
1369
+ @ across the entire route between your browser and the server.
1370
+ @ An attempt was made to redirect to %h(g.zHttpsURL) but
1371
+ @ the connection is still insecure even after the redirect.</p>
1372
+ @ <p>This is probably some kind of configuration problem. Please
1373
+ @ contact your sysadmin.</p>
1374
+ @ <p>Sorry it did not work out.</p>
1375
+ style_footer();
1376
+ cgi_reply();
1377
+ return 1;
1378
+ }
1379
+ if( zQS==0 || zQS[0]==0 ){
1380
+ zURL = mprintf("%s%T?redir=1", g.zHttpsURL, P("PATH_INFO"));
1381
+ }else if( zQS[0]!=0 ){
1382
+ zURL = mprintf("%s%T?%s&redir=1", g.zHttpsURL, P("PATH_INFO"), zQS);
1383
+ }
1384
+ cgi_redirect_with_status(zURL, 301, "Moved Permanently");
1385
+ return 1;
1386
+ }
1387
+ return 0;
1388
+}
13391389
13401390
 /*
13411391
 ** Preconditions:
13421392
 **
13431393
 ** * Environment variables are set up according to the CGI standard.
@@ -1609,10 +1659,11 @@
16091659
16101660
 /* Use the first element of PATH_INFO as the page name
16111661
 ** and deliver the appropriate page back to the user.
16121662
 */
16131663
 set_base_url(0);
1664
+ if( fossil_redirect_to_https_if_needed(2) ) return;
16141665
 if( zPathInfo==0 || zPathInfo[0]==0
16151666
 || (zPathInfo[0]=='/' && zPathInfo[1]==0) ){
16161667
 /* Second special case: If the PATH_INFO is blank, issue a redirect to
16171668
 ** the home page identified by the "index-page" setting in the repository
16181669
 ** CONFIG table, to "/index" if there no "index-page" setting. */
@@ -2427,11 +2478,12 @@
24272478
 ** --https signal a request coming in via https
24282479
 ** --max-latency N Do not let any single HTTP request run for more than N
24292480
 ** seconds (only works on unix)
24302481
 ** --nocompress Do not compress HTTP replies
24312482
 ** --nojail Drop root privileges but do not enter the chroot jail
2432
-** --nossl signal that no SSL connections are available
2483
+** --nossl signal that no SSL connections are available (Always
2484
+** set by default for the "ui" command)
24332485
 ** --notfound URL Redirect
24342486
 ** -P|--port TCPPORT listen to request on port TCPPORT
24352487
 ** --th-trace trace TH1 execution (for debugging purposes)
24362488
 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
24372489
 ** --scgi Accept SCGI rather than HTTP
@@ -2498,11 +2550,11 @@
24982550
 fCreate = find_option("create",0,0)!=0;
24992551
 if( find_option("scgi", 0, 0)!=0 ) flags |= HTTP_SERVER_SCGI;
25002552
 if( zAltBase ){
25012553
 set_base_url(zAltBase);
25022554
 }
2503
- g.sslNotAvailable = find_option("nossl", 0, 0)!=0;
2555
+ g.sslNotAvailable = find_option("nossl", 0, 0)!=0 || isUiCmd;
25042556
 if( find_option("https",0,0)!=0 ){
25052557
 cgi_replace_parameter("HTTPS","on");
25062558
 }
25072559
 if( find_option("localhost", 0, 0)!=0 ){
25082560
 flags |= HTTP_SERVER_LOCALHOST;
25092561
--- src/main.c
+++ src/main.c
@@ -1334,10 +1334,60 @@
1334 }
1335 #endif
1336 db_panic_close();
1337 exit(1);
1338 }
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1339
1340 /*
1341 ** Preconditions:
1342 **
1343 ** * Environment variables are set up according to the CGI standard.
@@ -1609,10 +1659,11 @@
1609
1610 /* Use the first element of PATH_INFO as the page name
1611 ** and deliver the appropriate page back to the user.
1612 */
1613 set_base_url(0);
 
1614 if( zPathInfo==0 || zPathInfo[0]==0
1615 || (zPathInfo[0]=='/' && zPathInfo[1]==0) ){
1616 /* Second special case: If the PATH_INFO is blank, issue a redirect to
1617 ** the home page identified by the "index-page" setting in the repository
1618 ** CONFIG table, to "/index" if there no "index-page" setting. */
@@ -2427,11 +2478,12 @@
2427 ** --https signal a request coming in via https
2428 ** --max-latency N Do not let any single HTTP request run for more than N
2429 ** seconds (only works on unix)
2430 ** --nocompress Do not compress HTTP replies
2431 ** --nojail Drop root privileges but do not enter the chroot jail
2432 ** --nossl signal that no SSL connections are available
 
2433 ** --notfound URL Redirect
2434 ** -P|--port TCPPORT listen to request on port TCPPORT
2435 ** --th-trace trace TH1 execution (for debugging purposes)
2436 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
2437 ** --scgi Accept SCGI rather than HTTP
@@ -2498,11 +2550,11 @@
2498 fCreate = find_option("create",0,0)!=0;
2499 if( find_option("scgi", 0, 0)!=0 ) flags |= HTTP_SERVER_SCGI;
2500 if( zAltBase ){
2501 set_base_url(zAltBase);
2502 }
2503 g.sslNotAvailable = find_option("nossl", 0, 0)!=0;
2504 if( find_option("https",0,0)!=0 ){
2505 cgi_replace_parameter("HTTPS","on");
2506 }
2507 if( find_option("localhost", 0, 0)!=0 ){
2508 flags |= HTTP_SERVER_LOCALHOST;
2509
--- src/main.c
+++ src/main.c
@@ -1334,10 +1334,60 @@
1334 }
1335 #endif
1336 db_panic_close();
1337 exit(1);
1338 }
1339
1340 /*
1341 ** Return true if it is appropriate to redirect requests to HTTPS.
1342 **
1343 ** Redirect to https is appropriate if all of the above are true:
1344 ** (1) The redirect-to-https flag has a valud of iLevel or greater.
1345 ** (2) The current connection is http, not https or ssh
1346 ** (3) The sslNotAvailable flag is clear
1347 */
1348 int fossil_wants_https(int iLevel){
1349 if( g.sslNotAvailable ) return 0;
1350 if( db_get_int("redirect-to-https",0)<iLevel ) return 0;
1351 if( P("HTTPS")!=0 ) return 0;
1352 return 1;
1353 }
1354
1355 /*
1356 ** Redirect to the equivalent HTTPS request if the current connection is
1357 ** insecure and if the redirect-to-https flag greater than or equal to
1358 ** iLevel. iLevel is 1 for /login pages and 2 for every other page.
1359 */
1360 int fossil_redirect_to_https_if_needed(int iLevel){
1361 if( fossil_wants_https(iLevel) ){
1362 const char *zQS = P("QUERY_STRING");
1363 char *zURL;
1364 if( P("redir")!=0 ){
1365 style_header("Insecure Connection");
1366 @ <h1>Unable To Establish An Encrypted Connection</h1>
1367 @ <p>This website requires an encrypted connection.
1368 @ The current connection is not encrypted
1369 @ across the entire route between your browser and the server.
1370 @ An attempt was made to redirect to %h(g.zHttpsURL) but
1371 @ the connection is still insecure even after the redirect.</p>
1372 @ <p>This is probably some kind of configuration problem. Please
1373 @ contact your sysadmin.</p>
1374 @ <p>Sorry it did not work out.</p>
1375 style_footer();
1376 cgi_reply();
1377 return 1;
1378 }
1379 if( zQS==0 || zQS[0]==0 ){
1380 zURL = mprintf("%s%T?redir=1", g.zHttpsURL, P("PATH_INFO"));
1381 }else if( zQS[0]!=0 ){
1382 zURL = mprintf("%s%T?%s&redir=1", g.zHttpsURL, P("PATH_INFO"), zQS);
1383 }
1384 cgi_redirect_with_status(zURL, 301, "Moved Permanently");
1385 return 1;
1386 }
1387 return 0;
1388 }
1389
1390 /*
1391 ** Preconditions:
1392 **
1393 ** * Environment variables are set up according to the CGI standard.
@@ -1609,10 +1659,11 @@
1659
1660 /* Use the first element of PATH_INFO as the page name
1661 ** and deliver the appropriate page back to the user.
1662 */
1663 set_base_url(0);
1664 if( fossil_redirect_to_https_if_needed(2) ) return;
1665 if( zPathInfo==0 || zPathInfo[0]==0
1666 || (zPathInfo[0]=='/' && zPathInfo[1]==0) ){
1667 /* Second special case: If the PATH_INFO is blank, issue a redirect to
1668 ** the home page identified by the "index-page" setting in the repository
1669 ** CONFIG table, to "/index" if there no "index-page" setting. */
@@ -2427,11 +2478,12 @@
2478 ** --https signal a request coming in via https
2479 ** --max-latency N Do not let any single HTTP request run for more than N
2480 ** seconds (only works on unix)
2481 ** --nocompress Do not compress HTTP replies
2482 ** --nojail Drop root privileges but do not enter the chroot jail
2483 ** --nossl signal that no SSL connections are available (Always
2484 ** set by default for the "ui" command)
2485 ** --notfound URL Redirect
2486 ** -P|--port TCPPORT listen to request on port TCPPORT
2487 ** --th-trace trace TH1 execution (for debugging purposes)
2488 ** --repolist If REPOSITORY is dir, URL "/" lists repos.
2489 ** --scgi Accept SCGI rather than HTTP
@@ -2498,11 +2550,11 @@
2550 fCreate = find_option("create",0,0)!=0;
2551 if( find_option("scgi", 0, 0)!=0 ) flags |= HTTP_SERVER_SCGI;
2552 if( zAltBase ){
2553 set_base_url(zAltBase);
2554 }
2555 g.sslNotAvailable = find_option("nossl", 0, 0)!=0 || isUiCmd;
2556 if( find_option("https",0,0)!=0 ){
2557 cgi_replace_parameter("HTTPS","on");
2558 }
2559 if( find_option("localhost", 0, 0)!=0 ){
2560 flags |= HTTP_SERVER_LOCALHOST;
2561
M src/setup.c
+16 -8
--- src/setup.c
+++ src/setup.c
@@ -284,11 +284,11 @@
284284
 const char *zLabel, /* The text label on the menu */
285285
 const char *zVar, /* The corresponding row in the VAR table */
286286
 const char *zQP, /* The query parameter */
287287
 const char *zDflt, /* Default value if VAR table entry does not exist */
288288
 int nChoice, /* Number of choices */
289
- const char *const *azChoice /* Choices. 2 per choice: (VAR value, Display) */
289
+ const char *const *azChoice /* Choices in pairs (VAR value, Display) */
290290
 ){
291291
 const char *z = db_get(zVar, zDflt);
292292
 const char *zQ = P(zQP);
293293
 int i;
294294
 if( zQ && fossil_strcmp(zQ,z)!=0){
@@ -312,10 +312,15 @@
312312
 ** WEBPAGE: setup_access
313313
 **
314314
 ** The access-control settings page. Requires Setup privileges.
315315
 */
316316
 void setup_access(void){
317
+ static const char * const azRedirectOpts[] = {
318
+ "0", "Off",
319
+ "1", "Login Page Only",
320
+ "2", "All Pages"
321
+ };
317322
 login_check_credentials();
318323
 if( !g.perm.Setup ){
319324
 login_needed(0);
320325
 return;
321326
 }
@@ -324,18 +329,21 @@
324329
 db_begin_transaction();
325330
 @ <form action="%s(g.zTop)/setup_access" method="post"><div>
326331
 login_insert_csrf_secret();
327332
 @ <input type="submit" name="submit" value="Apply Changes" /></p>
328333
 @ <hr />
329
- onoff_attribute("Redirect to HTTPS on the Login page",
330
- "redirect-to-https", "redirhttps", 0, 0);
331
- @ <p>When selected, force the use of HTTPS for the Login page.
332
- @ <p>Details: When enabled, this option causes the $secureurl TH1
334
+ multiple_choice_attribute("Redirect to HTTPS",
335
+ "redirect-to-https", "redirhttps", "0",
336
+ count(azRedirectOpts)/2, azRedirectOpts);
337
+ @ <p>Force the use of HTTPS by redirecting to HTTPS when an
338
+ @ unencrypted request is received. This feature can be enabled
339
+ @ for the Login page only, or for all pages.
340
+ @ <p>Further details: When enabled, this option causes the $secureurl TH1
333341
 @ variable is set to an "https:" variant of $baseurl. Otherwise,
334
- @ $secureurl is just an alias for $baseurl. Also when enabled, the
335
- @ Login page redirects to https if accessed via http.
336
- @ (Property: "redirect-to-https")
342
+ @ $secureurl is just an alias for $baseurl.
343
+ @ (Property: "redirect-to-https". "0" for off, "1" for Login page only,
344
+ @ "2" otherwise.)
337345
 @ <hr />
338346
 onoff_attribute("Require password for local access",
339347
 "localauth", "localauth", 0, 0);
340348
 @ <p>When enabled, the password sign-in is always required for
341349
 @ web access. When disabled, unrestricted web access from 127.0.0.1
342350
--- src/setup.c
+++ src/setup.c
@@ -284,11 +284,11 @@
284 const char *zLabel, /* The text label on the menu */
285 const char *zVar, /* The corresponding row in the VAR table */
286 const char *zQP, /* The query parameter */
287 const char *zDflt, /* Default value if VAR table entry does not exist */
288 int nChoice, /* Number of choices */
289 const char *const *azChoice /* Choices. 2 per choice: (VAR value, Display) */
290 ){
291 const char *z = db_get(zVar, zDflt);
292 const char *zQ = P(zQP);
293 int i;
294 if( zQ && fossil_strcmp(zQ,z)!=0){
@@ -312,10 +312,15 @@
312 ** WEBPAGE: setup_access
313 **
314 ** The access-control settings page. Requires Setup privileges.
315 */
316 void setup_access(void){
 
 
 
 
 
317 login_check_credentials();
318 if( !g.perm.Setup ){
319 login_needed(0);
320 return;
321 }
@@ -324,18 +329,21 @@
324 db_begin_transaction();
325 @ <form action="%s(g.zTop)/setup_access" method="post"><div>
326 login_insert_csrf_secret();
327 @ <input type="submit" name="submit" value="Apply Changes" /></p>
328 @ <hr />
329 onoff_attribute("Redirect to HTTPS on the Login page",
330 "redirect-to-https", "redirhttps", 0, 0);
331 @ <p>When selected, force the use of HTTPS for the Login page.
332 @ <p>Details: When enabled, this option causes the $secureurl TH1
 
 
 
333 @ variable is set to an "https:" variant of $baseurl. Otherwise,
334 @ $secureurl is just an alias for $baseurl. Also when enabled, the
335 @ Login page redirects to https if accessed via http.
336 @ (Property: "redirect-to-https")
337 @ <hr />
338 onoff_attribute("Require password for local access",
339 "localauth", "localauth", 0, 0);
340 @ <p>When enabled, the password sign-in is always required for
341 @ web access. When disabled, unrestricted web access from 127.0.0.1
342
--- src/setup.c
+++ src/setup.c
@@ -284,11 +284,11 @@
284 const char *zLabel, /* The text label on the menu */
285 const char *zVar, /* The corresponding row in the VAR table */
286 const char *zQP, /* The query parameter */
287 const char *zDflt, /* Default value if VAR table entry does not exist */
288 int nChoice, /* Number of choices */
289 const char *const *azChoice /* Choices in pairs (VAR value, Display) */
290 ){
291 const char *z = db_get(zVar, zDflt);
292 const char *zQ = P(zQP);
293 int i;
294 if( zQ && fossil_strcmp(zQ,z)!=0){
@@ -312,10 +312,15 @@
312 ** WEBPAGE: setup_access
313 **
314 ** The access-control settings page. Requires Setup privileges.
315 */
316 void setup_access(void){
317 static const char * const azRedirectOpts[] = {
318 "0", "Off",
319 "1", "Login Page Only",
320 "2", "All Pages"
321 };
322 login_check_credentials();
323 if( !g.perm.Setup ){
324 login_needed(0);
325 return;
326 }
@@ -324,18 +329,21 @@
329 db_begin_transaction();
330 @ <form action="%s(g.zTop)/setup_access" method="post"><div>
331 login_insert_csrf_secret();
332 @ <input type="submit" name="submit" value="Apply Changes" /></p>
333 @ <hr />
334 multiple_choice_attribute("Redirect to HTTPS",
335 "redirect-to-https", "redirhttps", "0",
336 count(azRedirectOpts)/2, azRedirectOpts);
337 @ <p>Force the use of HTTPS by redirecting to HTTPS when an
338 @ unencrypted request is received. This feature can be enabled
339 @ for the Login page only, or for all pages.
340 @ <p>Further details: When enabled, this option causes the $secureurl TH1
341 @ variable is set to an "https:" variant of $baseurl. Otherwise,
342 @ $secureurl is just an alias for $baseurl.
343 @ (Property: "redirect-to-https". "0" for off, "1" for Login page only,
344 @ "2" otherwise.)
345 @ <hr />
346 onoff_attribute("Require password for local access",
347 "localauth", "localauth", 0, 0);
348 @ <p>When enabled, the password sign-in is always required for
349 @ web access. When disabled, unrestricted web access from 127.0.0.1
350
M src/style.c
+2 -2
--- src/style.c
+++ src/style.c
@@ -412,11 +412,11 @@
412412
 Th_Store("nonce", style_nonce());
413413
 Th_Store("project_name", db_get("project-name","Unnamed Fossil Project"));
414414
 Th_Store("project_description", db_get("project-description",""));
415415
 if( zTitle ) Th_Store("title", zTitle);
416416
 Th_Store("baseurl", g.zBaseURL);
417
- Th_Store("secureurl", login_wants_https_redirect()? g.zHttpsURL: g.zBaseURL);
417
+ Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
418418
 Th_Store("home", g.zTop);
419419
 Th_Store("index_page", db_get("index-page","/home"));
420420
 if( local_zCurrentPage==0 ) style_set_current_page("%T", g.zPath);
421421
 Th_Store("current_page", local_zCurrentPage);
422422
 Th_Store("csrf_token", g.zCsrfToken);
@@ -914,11 +914,11 @@
914914
915915
 /* Process through TH1 in order to give an opportunity to substitute
916916
 ** variables such as $baseurl.
917917
 */
918918
 Th_Store("baseurl", g.zBaseURL);
919
- Th_Store("secureurl", login_wants_https_redirect()? g.zHttpsURL: g.zBaseURL);
919
+ Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
920920
 Th_Store("home", g.zTop);
921921
 image_url_var("logo");
922922
 image_url_var("background");
923923
 Th_Render(blob_str(&css));
924924
925925
--- src/style.c
+++ src/style.c
@@ -412,11 +412,11 @@
412 Th_Store("nonce", style_nonce());
413 Th_Store("project_name", db_get("project-name","Unnamed Fossil Project"));
414 Th_Store("project_description", db_get("project-description",""));
415 if( zTitle ) Th_Store("title", zTitle);
416 Th_Store("baseurl", g.zBaseURL);
417 Th_Store("secureurl", login_wants_https_redirect()? g.zHttpsURL: g.zBaseURL);
418 Th_Store("home", g.zTop);
419 Th_Store("index_page", db_get("index-page","/home"));
420 if( local_zCurrentPage==0 ) style_set_current_page("%T", g.zPath);
421 Th_Store("current_page", local_zCurrentPage);
422 Th_Store("csrf_token", g.zCsrfToken);
@@ -914,11 +914,11 @@
914
915 /* Process through TH1 in order to give an opportunity to substitute
916 ** variables such as $baseurl.
917 */
918 Th_Store("baseurl", g.zBaseURL);
919 Th_Store("secureurl", login_wants_https_redirect()? g.zHttpsURL: g.zBaseURL);
920 Th_Store("home", g.zTop);
921 image_url_var("logo");
922 image_url_var("background");
923 Th_Render(blob_str(&css));
924
925
--- src/style.c
+++ src/style.c
@@ -412,11 +412,11 @@
412 Th_Store("nonce", style_nonce());
413 Th_Store("project_name", db_get("project-name","Unnamed Fossil Project"));
414 Th_Store("project_description", db_get("project-description",""));
415 if( zTitle ) Th_Store("title", zTitle);
416 Th_Store("baseurl", g.zBaseURL);
417 Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
418 Th_Store("home", g.zTop);
419 Th_Store("index_page", db_get("index-page","/home"));
420 if( local_zCurrentPage==0 ) style_set_current_page("%T", g.zPath);
421 Th_Store("current_page", local_zCurrentPage);
422 Th_Store("csrf_token", g.zCsrfToken);
@@ -914,11 +914,11 @@
914
915 /* Process through TH1 in order to give an opportunity to substitute
916 ** variables such as $baseurl.
917 */
918 Th_Store("baseurl", g.zBaseURL);
919 Th_Store("secureurl", fossil_wants_https(1)? g.zHttpsURL: g.zBaseURL);
920 Th_Store("home", g.zTop);
921 image_url_var("logo");
922 image_url_var("background");
923 Th_Render(blob_str(&css));
924
925

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button