diff options
| author | Simon Rettberg | 2017-05-05 13:04:19 +0200 |
|---|---|---|
| committer | Simon Rettberg | 2017-05-05 13:04:19 +0200 |
| commit | f7900fa08276d2668221a1b4ce7462d68e6f2893 (patch) | |
| tree | 420646ef6fdb71ca1ce088e1bf4a0f6cf31198fe /modules-available/webinterface | |
| parent | [webinterface] Add separate option to enable HSTS (diff) | |
| download | slx-admin-f7900fa08276d2668221a1b4ce7462d68e6f2893.tar.gz slx-admin-f7900fa08276d2668221a1b4ce7462d68e6f2893.tar.xz slx-admin-f7900fa08276d2668221a1b4ce7462d68e6f2893.zip | |
[webinterface] Log user out when disabling HTTPS to prevent lockout
Diffstat (limited to 'modules-available/webinterface')
| -rw-r--r-- | modules-available/webinterface/page.inc.php | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/modules-available/webinterface/page.inc.php b/modules-available/webinterface/page.inc.php index 5207420a..ae9a94fd 100644 --- a/modules-available/webinterface/page.inc.php +++ b/modules-available/webinterface/page.inc.php @@ -26,12 +26,10 @@ class Page_WebInterface extends Page private function actionConfigureHttps() { - $task = false; - $off = ''; - switch (Request::post('mode')) { + $mode = Request::post('mode'); + switch ($mode) { case 'off': $task = $this->setHttpsOff(); - $off = '&hsts=off'; break; case 'random': $task = $this->setHttpsRandomCert(); @@ -43,10 +41,12 @@ class Page_WebInterface extends Page $task = $this->setRedirectMode(); break; } - Property::set(self::PROP_HSTS, Request::post('usehsts', false, 'string') === 'on' ? 'True' : 'False'); + if ($mode !== 'off') { + Property::set(self::PROP_HSTS, Request::post('usehsts', false, 'string') === 'on' ? 'True' : 'False'); + } if (isset($task['id'])) { Session::set('https-id', $task['id']); - Util::redirect('?do=WebInterface&show=httpsupdate' . $off); + Util::redirect('?do=WebInterface&show=httpsupdate'); } Util::redirect('?do=WebInterface'); } @@ -123,7 +123,9 @@ class Page_WebInterface extends Page private function setHttpsOff() { Property::set(self::PROP_TYPE, 'off'); + Property::set(self::PROP_HSTS, 'off'); Header('Strict-Transport-Security: max-age=0', true); + Session::deleteCookie(); return Taskmanager::submit('LighttpdHttps', array()); } |