Either use or don't use HTTPS

The risk of injection attacks using HTTP is too great to allow a
site that allows both HTTP and HTTPS...

diff --git a/actions/pathsadminpanel.php b/actions/pathsadminpanel.php
index 57f82e799538c717d72af11d87b79e05a21022b8..6b11df6f317131c4a265f9b0f8355741176f1acd 100644 (file)
--- a/actions/pathsadminpanel.php
+++ b/actions/pathsadminpanel.php
@@ -417,8 +417,6 @@ class PathsAdminPanelForm extends AdminForm
 
         // TRANS: Drop down option in Paths admin panel (option for "When to use SSL").
         $ssl = array('never' => _('Never'),
-                     // TRANS: Drop down option in Paths admin panel (option for "When to use SSL").
-                     'sometimes' => _('Sometimes'),
                       // TRANS: Drop down option in Paths admin panel (option for "When to use SSL").
                      'always' => _('Always'));
 

diff --git a/classes/Avatar.php b/classes/Avatar.php
index 5ce2712dfb96bae77f06a5bf8fdd484116e25185..d8cc134b80ff44819f6c942e93d45a0d19726ec7 100644 (file)
--- a/classes/Avatar.php
+++ b/classes/Avatar.php
@@ -187,16 +187,7 @@ class Avatar extends Managed_DataObject
             $server = common_config('site', 'server');
         }
 
-        $ssl = common_config('avatar', 'ssl');
-
-        if (is_null($ssl)) { // null -> guess
-            if (common_config('site', 'ssl') == 'always' &&
-                !common_config('avatar', 'server')) {
-                $ssl = true;
-            } else {
-                $ssl = false;
-            }
-        }
+        $ssl = (common_config('avatar', 'ssl') || GNUsocial::useHTTPS());
 
         $protocol = ($ssl) ? 'https' : 'http';
 

diff --git a/install.php b/install.php
index 2752c967677cddc4dc07e68d43537893fbe4413e..716e1c370a30da229eb6afc31d909caabbc29edf 100644 (file)
--- a/install.php
+++ b/install.php
@@ -350,7 +350,7 @@ STR;
             $fail = true;
         }
 
-        if (!in_array($this->ssl, array('never', 'sometimes', 'always'))) {
+        if (!in_array($this->ssl, array('never', 'always'))) {
             $this->updateStatus("Bad value for server SSL enabling.");
             $fail = true;
         }

diff --git a/lib/installer.php b/lib/installer.php
index 650845f0f06712b16958fca6c865dd3eba3650fe..d2fda9256094a0dfff2b2e2454a71511a3add094 100644 (file)
--- a/lib/installer.php
+++ b/lib/installer.php
@@ -405,7 +405,7 @@ abstract class Installer
             'sitename' => $this->sitename,
             'server' => $this->server,
             'path' => $this->path,
-            'ssl' => in_array($this->ssl, array('never', 'sometimes', 'always'))
+            'ssl' => in_array($this->ssl, array('never', 'always'))
                      ? $this->ssl
                      : 'never',
             'db_database' => $this->db['database'],

diff --git a/lib/util.php b/lib/util.php
index 98d8ac220b93c69b9cf695846989277a94754b16..6a5c310193287b44edface3820b94a0100d2fdcf 100644 (file)
--- a/lib/util.php
+++ b/lib/util.php
@@ -354,7 +354,7 @@ function common_set_cookie($key, $value, $expiration=0)
                      $expiration,
                      $cookiepath,
                      $server,
-                     common_config('site', 'ssl')=='always');
+                     GNUsocial::useHTTPS());
 }
 
 define('REMEMBERME', 'rememberme');
@@ -1345,9 +1345,7 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad
         $r = Router::get();
         $path = $r->build($action, $args, $params, $fragment);
 
-        $ssl = common_config('site', 'ssl') === 'always'
-                || GNUsocial::isHTTPS()
-                || common_is_sensitive($action);
+        $ssl = GNUsocial::useHTTPS();
 
         if (common_config('site','fancy')) {
             $url = common_path($path, $ssl, $addSession);
@@ -1363,35 +1361,11 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad
     return $url;
 }
 
-function common_is_sensitive($action)
-{
-    static $sensitive = array(
-        'login',
-        'register',
-        'passwordsettings',
-        'api',
-        'ApiOAuthRequestToken',
-        'ApiOAuthAccessToken',
-        'ApiOAuthAuthorize',
-        'ApiOAuthPin',
-        'showapplication'
-    );
-    $ssl = null;
-
-    if (Event::handle('SensitiveAction', array($action, &$ssl))) {
-        $ssl = in_array($action, $sensitive);
-    }
-
-    return $ssl;
-}
-
 function common_path($relative, $ssl=false, $addSession=true)
 {
     $pathpart = (common_config('site', 'path')) ? common_config('site', 'path')."/" : '';
 
-    if (($ssl && (common_config('site', 'ssl') === 'sometimes'))
-        || GNUsocial::isHTTPS()
-        || common_config('site', 'ssl') === 'always') {
+    if ($ssl && GNUsocial::useHTTPS()) {
         $proto = 'https';
         if (is_string(common_config('site', 'sslserver')) &&
             mb_strlen(common_config('site', 'sslserver')) > 0) {

diff --git a/plugins/FacebookBridge/FacebookBridgePlugin.php b/plugins/FacebookBridge/FacebookBridgePlugin.php
index a19cc0349bf7b2a7f18bee6b8bba243f3fa4928a..88dc4df496009ac3daf95050a908291c22de95f9 100644 (file)
--- a/plugins/FacebookBridge/FacebookBridgePlugin.php
+++ b/plugins/FacebookBridge/FacebookBridgePlugin.php
@@ -472,30 +472,6 @@ ENDOFSCRIPT;
         return true;
     }
 
-    /*
-     * Use SSL for Facebook stuff
-     *
-     * @param string $action name
-     * @param boolean $ssl outval to force SSL
-     * @return mixed hook return value
-     */
-    function onSensitiveAction($action, &$ssl)
-    {
-        $sensitive = array(
-            'facebookadminpanel',
-            'facebooksettings',
-            'facebooklogin',
-            'facebookfinishlogin'
-        );
-
-        if (in_array($action, $sensitive)) {
-            $ssl = true;
-            return false;
-        } else {
-            return true;
-        }
-    }
-
     /**
      * If a notice gets deleted, remove the Notice_to_item mapping and
      * delete the item on Facebook

diff --git a/plugins/OpenID/OpenIDPlugin.php b/plugins/OpenID/OpenIDPlugin.php
index 4e5a0bfe0cb0068799a52a9a76879cda747e879d..c6f2d75a2b2a292127bb339247fcf1fc5435062f 100644 (file)
--- a/plugins/OpenID/OpenIDPlugin.php
+++ b/plugins/OpenID/OpenIDPlugin.php
@@ -329,29 +329,6 @@ class OpenIDPlugin extends Plugin
         return parent::onAutoload($cls);
     }
 
-    /**
-     * Sensitive actions
-     *
-     * These actions should use https when SSL support is 'sometimes'
-     *
-     * @param Action  $action Action to form an URL for
-     * @param boolean &$ssl   Whether to mark it for SSL
-     *
-     * @return boolean hook return
-     */
-    function onSensitiveAction($action, &$ssl)
-    {
-        switch ($action)
-        {
-        case 'finishopenidlogin':
-        case 'finishaddopenid':
-            $ssl = true;
-            return false;
-        default:
-            return true;
-        }
-    }
-
     /**
      * Login actions
      *

diff --git a/plugins/StrictTransportSecurity/README b/plugins/StrictTransportSecurity/README
index 66f03e95ead6cf2d2a85f7cd4224f333233a1b90..73c1d5a7da007815b9759948d1423f19a8a91b43 100644 (file)
--- a/plugins/StrictTransportSecurity/README
+++ b/plugins/StrictTransportSecurity/README
@@ -7,7 +7,7 @@ add "addPlugin('strictTransportSecurity');"
 to the bottom of your config.php
 
 The plugin will not do anything unless:
-$config['site']['ssl'] is set to 'always'
+$config['site']['ssl'] is set to something other than 'never'
 $config['site']['path'] is either not set, empty, or '/'
 
 Settings

diff --git a/plugins/StrictTransportSecurity/StrictTransportSecurityPlugin.php b/plugins/StrictTransportSecurity/StrictTransportSecurityPlugin.php
index 74a643d6d939c96200dfb16da19914f8864c35f2..67cb66501801f5a7dca45cbf2978662163897a8f 100644 (file)
--- a/plugins/StrictTransportSecurity/StrictTransportSecurityPlugin.php
+++ b/plugins/StrictTransportSecurity/StrictTransportSecurityPlugin.php
@@ -43,7 +43,7 @@ class StrictTransportSecurityPlugin extends Plugin
     function onArgsInitialize($args)
     {
         $path = common_config('site', 'path');
-        if(common_config('site', 'ssl') == 'always' && ($path == '/' || ! $path )) {
+        if (GNUsocial::useHTTPS() && ($path == '/' || mb_strlen($path)==0 )) {
             header('Strict-Transport-Security: max-age=' . $this->max_age
                     . ($this->includeSubDomains ? '; includeSubDomains' : '')
                     . ($this->preloadToken ? '; preload' : ''));

diff --git a/plugins/TwitterBridge/TwitterBridgePlugin.php b/plugins/TwitterBridge/TwitterBridgePlugin.php
index 72c28d4fa45eb4dfc4eefbaa1528cc357bf9055e..623e2b51d8471250b90c0d6c74b1c7836d0f3fdd 100644 (file)
--- a/plugins/TwitterBridge/TwitterBridgePlugin.php
+++ b/plugins/TwitterBridge/TwitterBridgePlugin.php
@@ -323,31 +323,6 @@ class TwitterBridgePlugin extends Plugin
         return (bool)$this->adminImportControl;
     }
 
-    /**
-     * When the site is set to ssl=sometimes mode, we should make sure our
-     * various auth-related pages are on SSL to keep things looking happy.
-     * Although we're not submitting passwords directly, we do link out to
-     * an authentication source and it's a lot happier if we've got some
-     * protection against MitM.
-     *
-     * @param string $action name
-     * @param boolean $ssl outval to force SSL
-     * @return mixed hook return value
-     */
-    function onSensitiveAction($action, &$ssl)
-    {
-        $sensitive = array('twitteradminpanel',
-                           'twittersettings',
-                           'twitterauthorization',
-                           'twitterlogin');
-        if (in_array($action, $sensitive)) {
-            $ssl = true;
-            return false;
-        } else {
-            return true;
-        }
-    }
-
     /**
      * Database schema setup
      *

diff --git a/scripts/install_cli.php b/scripts/install_cli.php
index ac3fe3e6573125c8347054d70ea13c30f6cab70f..815418aaab51ee942114700947678df4195851a9 100755 (executable)
--- a/scripts/install_cli.php
+++ b/scripts/install_cli.php
@@ -161,7 +161,7 @@ install_cli.php - StatusNet command-line installer
        --sitename        User-friendly site name (required)
        --fancy           Whether to use fancy URLs (default no)
        --ssl             Server SSL enabled (default never), 
-                         [never | sometimes | always]
+                         [never | always]
 
        --dbtype          'mysql' (default) or 'pgsql'
        --host            Database hostname (required)