Redirect non-SSL hits to login & register actions to SSL if 'always' or 'sometimes...

[quix0rs-gnu-social.git] / actions / login.php

diff --git a/actions/login.php b/actions/login.php
index dc6352368a698e0753619bdb9827df4b555585d9..d3e4312f71152f86e42047250f1361c95c8fd6df 100644 (file)
--- a/actions/login.php
+++ b/actions/login.php
@@ -62,6 +62,28 @@ class LoginAction extends Action
         return false;
     }
 
+    /**
+     * Prepare page to run
+     *
+     *
+     * @param $args
+     * @return string title
+     */
+
+    function prepare($args)
+    {
+        parent::prepare($args);
+
+        // @todo this check should really be in index.php for all sensitive actions
+        $ssl = common_config('site', 'ssl');
+        if (empty($_SERVER['HTTPS']) && ($ssl == 'always' || $ssl == 'sometimes')) {
+            common_redirect(common_local_url('login'));
+            // exit
+        }
+
+        return true;
+    }
+
     /**
      * Handle input, produce output
      *