From 20d885c77680fc082640c0a7340be44cd02b2779 Mon Sep 17 00:00:00 2001
From: "dkl%redhat.com" <>
Date: Mon, 18 Aug 2008 09:16:12 +0000
Subject: =?UTF-8?q?Bug=20428659=20=C3=A2=C2=80=C2=93=20Setting=20SSL=20par?=
 =?UTF-8?q?am=20to=20'authenticated=20sessions'=20only=20protects=20logins?=
 =?UTF-8?q?=20and=20param=20doesn't=20protect=20WebService=20calls=20at=20?=
 =?UTF-8?q?all=20Patch=20by=20David=20Lawrence=20<dkl@redhat.com>=20-=20r/?=
 =?UTF-8?q?a=3DLpSolit/mkanat?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 index.cgi | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'index.cgi')

diff --git a/index.cgi b/index.cgi
index 100941765..89880d163 100755
--- a/index.cgi
+++ b/index.cgi
@@ -46,7 +46,9 @@ my $user = Bugzilla->login(LOGIN_OPTIONAL);
 my $cgi = Bugzilla->cgi;
 # Force to use HTTPS unless Bugzilla->params->{'ssl'} equals 'never'.
 # This is required because the user may want to log in from here.
-if (Bugzilla->params->{'sslbase'} ne '' and Bugzilla->params->{'ssl'} ne 'never') {
+if ($cgi->protocol ne 'https' && Bugzilla->params->{'sslbase'} ne ''
+    && Bugzilla->params->{'ssl'} ne 'never')
+{
     $cgi->require_https(Bugzilla->params->{'sslbase'});
 }
 
-- 
cgit v1.2.1