diff options
| author | Lukas Reschke <lukas@owncloud.com> | 2014-11-03 10:55:52 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@owncloud.com> | 2014-11-03 16:53:03 +0100 |
| commit | e73ccbd4cade0622615ee133496a571ac1d6dba7 (patch) | |
| tree | 114c981b1ae7ae1e050dbfe74c1333b238a2b178 /lib/base.php | |
| parent | f8f38b06dfef0af2555124cf0d1ec55402aa8c8c (diff) | |
| download | nextcloud-server-e73ccbd4cade0622615ee133496a571ac1d6dba7.tar.gz nextcloud-server-e73ccbd4cade0622615ee133496a571ac1d6dba7.zip | |
Migrate "setsecurity.php" to the AppFramework
Add switch to enforce SSL for subdomains
Add unit tests
Add test for boolean values
Camel-case
Fix ugly JS
Diffstat (limited to 'lib/base.php')
| -rw-r--r-- | lib/base.php | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/lib/base.php b/lib/base.php index d428d45d90a..78ab9580b25 100644 --- a/lib/base.php +++ b/lib/base.php @@ -229,11 +229,18 @@ class OC { public static function checkSSL() { // redirect to https site if configured - if (OC_Config::getValue("forcessl", false)) { - header('Strict-Transport-Security: max-age=31536000'); - ini_set("session.cookie_secure", "on"); + if (\OC::$server->getConfig()->getSystemValue('forcessl', false)) { + // Default HSTS policy + $header = 'Strict-Transport-Security: max-age=31536000'; + + // If SSL for subdomains is enabled add "; includeSubDomains" to the header + if(\OC::$server->getConfig()->getSystemValue('forceSSLforSubdomains', false)) { + $header .= '; includeSubDomains'; + } + header($header); + ini_set('session.cookie_secure', 'on'); if (OC_Request::serverProtocol() <> 'https' and !OC::$CLI) { - $url = "https://" . OC_Request::serverHost() . OC_Request::requestUri(); + $url = 'https://' . OC_Request::serverHost() . OC_Request::requestUri(); header("Location: $url"); exit(); } |