From 1c9db1d1f14d5f83d8bd7dbbd535cf109680471f Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Thu, 11 Aug 2011 17:35:03 +0200 Subject: Add a configuration setting to disallow HTTP login If this is enabled, do not show the login form and display a note suggesting to switch to a secure connection if a user accesses the site via HTTP. Signed-off-by: Lukas Fleischer --- web/lib/aur.inc.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'web/lib/aur.inc.php') diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 0927604..474ebee 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -326,9 +326,12 @@ function html_header($title="") { global $_POST; global $LANG; global $SUPPORTED_LANGS; + global $DISABLE_HTTP_LOGIN; - $login = try_login(); - $login_error = $login['error']; + if (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { + $login = try_login(); + $login_error = $login['error']; + } $title = htmlspecialchars($title, ENT_QUOTES); -- cgit v1.3.1