Fix for #2635: use ssl-sometimes settings for Twitter settings & auth pages

diff --git a/lib/util.php b/lib/util.php
index 66600c766f023768634f4c3939c521d0ddde95ce..f63e152e33aab65278d0366e931acd3cc43cb639 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -1018,8 +1018,7 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad
 
 function common_is_sensitive($action)
 {
-    static $sensitive = array('login', 'register', 'passwordsettings',
-                              'twittersettings', 'api');
+    static $sensitive = array('login', 'register', 'passwordsettings', 'api');
     $ssl = null;
 
     if (Event::handle('SensitiveAction', array($action, &$ssl))) {

diff --git a/plugins/TwitterBridge/TwitterBridgePlugin.php b/plugins/TwitterBridge/TwitterBridgePlugin.php
index 0505a328fb815f37cde82d37a9670984f3cbf99a..8e3eba3186dfa28535824660de39f6317fc98143 100644 (file)
--- a/plugins/TwitterBridge/TwitterBridgePlugin.php
+++ b/plugins/TwitterBridge/TwitterBridgePlugin.php
@@ -335,5 +335,30 @@ class TwitterBridgePlugin extends Plugin
         return (bool)$this->adminImportControl;
     }
 
+    /**
+     * When the site is set to ssl=sometimes mode, we should make sure our
+     * various auth-related pages are on SSL to keep things looking happy.
+     * Although we're not submitting passwords directly, we do link out to
+     * an authentication source and it's a lot happier if we've got some
+     * protection against MitM.
+     *
+     * @param string $action name
+     * @param boolean $ssl outval to force SSL
+     * @return mixed hook return value
+     */
+    function onSensitiveAction($action, &$ssl)
+    {
+        $sensitive = array('twitteradminpanel',
+                           'twittersettings',
+                           'twitterauthorization',
+                           'twitterlogin');
+        if (in_array($action, $sensitive)) {
+            $ssl = true;
+            return false;
+        } else {
+            return true;
+        }
+    }
+
 }