Anomie has submitted this change and it was merged.
Change subject: Added $wgMWOAuthSecureTokenTransfer to redirect users to HTTPS
in some cases
......................................................................
Added $wgMWOAuthSecureTokenTransfer to redirect users to HTTPS in some cases
Change-Id: I3e2e54fcc088417e149c2689bbdf440b1db4af1a
---
M OAuth.config.php
M frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
2 files changed, 13 insertions(+), 0 deletions(-)
Approvals:
Anomie: Verified; Looks good to me, approved
diff --git a/OAuth.config.php b/OAuth.config.php
index 3c4f9ae..6c498c5 100644
--- a/OAuth.config.php
+++ b/OAuth.config.php
@@ -50,5 +50,8 @@
$wgGroupPermissions['user']['mwoauthmanagemygrants'] = true;
+/** @var bool Require HTTPs for user transactions that might send out secret
tokens */
+$wgMWOAuthSecureTokenTransfer = false;
+
# End of configuration variables.
# ########
diff --git a/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
b/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
index 99a55f0..3f5e21d 100644
--- a/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
+++ b/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
@@ -35,6 +35,16 @@
}
public function execute( $par ) {
+ global $wgMWOAuthSecureTokenTransfer;
+
+ // Redirect to HTTPs if attempting to access this page via HTTP.
+ // Proposals and updates to consumers can involve sending new
secrets.
+ if ( $wgMWOAuthSecureTokenTransfer &&
WebRequest::detectProtocol() !== 'https' ) {
+ $url = $this->getFullTitle()->getFullURL( array(),
false, PROTO_HTTPS );
+ $this->getOutput()->redirect( $url );
+ return;
+ }
+
$user = $this->getUser();
$request = $this->getRequest();
--
To view, visit https://gerrit.wikimedia.org/r/75490
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I3e2e54fcc088417e149c2689bbdf440b1db4af1a
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/OAuth
Gerrit-Branch: master
Gerrit-Owner: Aaron Schulz <[email protected]>
Gerrit-Reviewer: Anomie <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
