jenkins-bot has submitted this change and it was merged.
Change subject: Cleaned up https redirect code to be more consistent
......................................................................
Cleaned up https redirect code to be more consistent
* $wgMWOAuthSecureTokenTransfer is checked for as needed
* Also made $wgMWOAuthSecureTokenTransfer on by default
bug: 54806
Change-Id: I211909953b0215a418358a8c72bac7977b118817
---
M OAuth.config.php
M frontend/specialpages/SpecialMWOAuth.php
M frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
3 files changed, 15 insertions(+), 9 deletions(-)
Approvals:
CSteipp: Looks good to me, approved
jenkins-bot: Verified
diff --git a/OAuth.config.php b/OAuth.config.php
index aac976d..b9e301f 100644
--- a/OAuth.config.php
+++ b/OAuth.config.php
@@ -174,7 +174,7 @@
$wgGroupPermissions['user']['mwoauthmanagemygrants'] = true;
/** @var bool Require HTTPs for user transactions that might send out secret
tokens */
-$wgMWOAuthSecureTokenTransfer = false;
+$wgMWOAuthSecureTokenTransfer = true; // RfC compliance
/** @var array List of API module classes to disable when OAuth is used for
the request. */
$wgMWOauthDisabledApiModules = array(
diff --git a/frontend/specialpages/SpecialMWOAuth.php
b/frontend/specialpages/SpecialMWOAuth.php
index e286f35..35e3b12 100644
--- a/frontend/specialpages/SpecialMWOAuth.php
+++ b/frontend/specialpages/SpecialMWOAuth.php
@@ -27,6 +27,8 @@
}
public function execute( $subpage ) {
+ global $wgMWOAuthSecureTokenTransfer;
+
$this->setHeaders();
$user = $this->getUser();
@@ -85,11 +87,13 @@
// We want to use HTTPS when returning
the credentials. But
// for RSA we don't need to return a
token secret, so HTTP is ok.
- if ( !$isRsa &&
$request->detectProtocol() == 'http'
+ if ( $wgMWOAuthSecureTokenTransfer &&
!$isRsa
+ && $request->detectProtocol()
== 'http'
&& substr( wfExpandUrl( '/',
PROTO_HTTPS ), 0, 8 ) === 'https://'
) {
$redirUrl = str_replace(
'http://', 'https://', $request->getFullRequestURL() );
$this->getOutput()->redirect(
$redirUrl );
+
$this->getOutput()->addVaryHeader( 'X-Forwarded-Proto' );
break;
}
diff --git a/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
b/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
index 12adfad..1453e93 100644
--- a/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
+++ b/frontend/specialpages/SpecialMWOAuthConsumerRegistration.php
@@ -37,19 +37,21 @@
public function execute( $par ) {
global $wgMWOAuthSecureTokenTransfer;
+ $request = $this->getRequest();
$user = $this->getUser();
$lang = $this->getLanguage();
$centralUserId = MWOAuthUtils::getCentralIdFromLocalUser( $user
);
// Redirect to HTTPs if attempting to access this page via HTTP.
// Proposals and updates to consumers can involve sending new
secrets.
- if ( $wgMWOAuthSecureTokenTransfer &&
WebRequest::detectProtocol() !== 'https' ) {
- $url = $this->getFullTitle()->getFullURL( array(),
false, PROTO_HTTPS );
- if ( substr( $url, 0, 8 ) === 'https://' ) {
- $this->getOutput()->redirect( $url );
- return;
- }
- throw new MWException( 'Cannot redirect to HTTPs;
$wgServer is not protocol relative' );
+ if ( $wgMWOAuthSecureTokenTransfer
+ && $request->detectProtocol() == 'http'
+ && substr( wfExpandUrl( '/', PROTO_HTTPS ), 0, 8 ) ===
'https://'
+ ) {
+ $redirUrl = str_replace( 'http://', 'https://',
$request->getFullRequestURL() );
+ $this->getOutput()->redirect( $redirUrl );
+ $this->getOutput()->addVaryHeader( 'X-Forwarded-Proto'
);
+ return;
}
$this->setHeaders();
--
To view, visit https://gerrit.wikimedia.org/r/86809
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I211909953b0215a418358a8c72bac7977b118817
Gerrit-PatchSet: 2
Gerrit-Project: mediawiki/extensions/OAuth
Gerrit-Branch: master
Gerrit-Owner: Aaron Schulz <[email protected]>
Gerrit-Reviewer: Anomie <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
