Bug 428659 – Setting SSL param to 'authenticated sessions' only protects logins and param

doesn't protect WebService calls at all
Patch by David Lawrence <dkl@redhat.com> - r/a=LpSolit/mkanat

1 files changed, 3 insertions, 2 deletions

diff --git a/token.cgi b/token.cgi
index c91c2f94f..d7f9f3c98 100755
--- a/token.cgi
+++ b/token.cgi
@@ -346,8 +346,9 @@ sub request_create_account {
     $vars->{'email'} = $login_name . Bugzilla->params->{'emailsuffix'};
     $vars->{'date'} = str2time($date);
 
-    # We require a HTTPS connection if possible.
-    if (Bugzilla->params->{'sslbase'} ne ''
+    # When 'ssl' equals 'always' or 'authenticated sessions', 
+    # we want this form to always be over SSL.
+    if ($cgi->protocol ne 'https' && Bugzilla->params->{'sslbase'} ne ''
         && Bugzilla->params->{'ssl'} ne 'never')
     {
         $cgi->require_https(Bugzilla->params->{'sslbase'});