diff options
| -rw-r--r-- | lib/util.php | 3 | ||||
| -rw-r--r-- | plugins/TwitterBridge/TwitterBridgePlugin.php | 25 |
2 files changed, 26 insertions, 2 deletions
diff --git a/lib/util.php b/lib/util.php index 66600c766..f63e152e3 100644 --- a/lib/util.php +++ b/lib/util.php @@ -1018,8 +1018,7 @@ function common_local_url($action, $args=null, $params=null, $fragment=null, $ad function common_is_sensitive($action) { - static $sensitive = array('login', 'register', 'passwordsettings', - 'twittersettings', 'api'); + static $sensitive = array('login', 'register', 'passwordsettings', 'api'); $ssl = null; if (Event::handle('SensitiveAction', array($action, &$ssl))) { diff --git a/plugins/TwitterBridge/TwitterBridgePlugin.php b/plugins/TwitterBridge/TwitterBridgePlugin.php index 0505a328f..8e3eba318 100644 --- a/plugins/TwitterBridge/TwitterBridgePlugin.php +++ b/plugins/TwitterBridge/TwitterBridgePlugin.php @@ -335,5 +335,30 @@ class TwitterBridgePlugin extends Plugin return (bool)$this->adminImportControl; } + /** + * When the site is set to ssl=sometimes mode, we should make sure our + * various auth-related pages are on SSL to keep things looking happy. + * Although we're not submitting passwords directly, we do link out to + * an authentication source and it's a lot happier if we've got some + * protection against MitM. + * + * @param string $action name + * @param boolean $ssl outval to force SSL + * @return mixed hook return value + */ + function onSensitiveAction($action, &$ssl) + { + $sensitive = array('twitteradminpanel', + 'twittersettings', + 'twitterauthorization', + 'twitterlogin'); + if (in_array($action, $sensitive)) { + $ssl = true; + return false; + } else { + return true; + } + } + } |