View source
<?php
define('SECUREPAGES_PAGES', 'node/add*
node/*/edit
node/*/delete
user
user/*
admin
admin/*');
define('SECUREPAGES_IGNORE', '');
function securepages_init() {
$is_https = securepages_is_secure();
if ($_GET['q'] == 'admin/build/securepages/test') {
if ($is_https) {
header('HTTP/1.1 200 OK');
}
else {
header('HTTP/1.1 404 Not Found');
}
exit;
}
if (variable_get('securepages_enable', 0) && basename($_SERVER['PHP_SELF']) == 'index.php' && php_sapi_name() != 'cli') {
securepages_redirect();
}
}
function securepages_menu() {
$items = array();
$items['admin/build/securepages'] = array(
'title' => 'Secure Pages',
'description' => 'Configure which pages are and are not to be viewed in SSL',
'page callback' => 'drupal_get_form',
'page arguments' => array(
'securepages_settings',
),
'access arguments' => array(
'administer site configuration',
),
'type' => MENU_NORMAL_ITEM,
'secure' => 1,
'file' => 'securepages.admin.inc',
);
return $items;
}
function securepages_form_alter(&$form, &$form_state, $form_id) {
$is_https = securepages_is_secure();
global $user;
if (!variable_get('securepages_enable', 0)) {
return;
}
if (isset($form['#action']) && securepages_can_alter_url($form['#action'])) {
$url = substr($form['#action'], strlen(base_path()));
$url = @parse_url($url);
$path = drupal_get_normal_path($url['path']);
$page_match = securepages_match($path);
$role_match = securepages_roles($user);
if ($role_match) {
if (!$is_https) {
$form['#action'] = url($path, array(
'absolute' => TRUE,
'base_url' => securepages_baseurl(TRUE),
));
}
return;
}
if ($page_match && !$is_https) {
$form['#action'] = url($path, array(
'absolute' => TRUE,
'base_url' => securepages_baseurl(TRUE),
));
}
elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE)) {
$form['#action'] = url($path, array(
'absolute' => TRUE,
'base_url' => securepages_baseurl(FALSE),
));
}
}
if (securepages_match('user/login') && $form_id == 'user_login_block' && !$is_https) {
$form['#action'] = url($path, array(
'absolute' => TRUE,
'base_url' => securepages_baseurl(TRUE),
));
}
}
function securepages_redirect() {
$is_https = securepages_is_secure();
global $base_url, $user;
$path = isset($_GET['q']) ? $_GET['q'] : '';
$page_match = securepages_match($path);
$role_match = securepages_roles($user);
if ($_POST) {
}
elseif ($role_match && !$is_https) {
securepages_goto(TRUE);
}
elseif ($page_match && !$is_https) {
securepages_goto(TRUE);
}
elseif ($page_match === 0 && $is_https && variable_get('securepages_switch', FALSE) && !$role_match) {
securepages_goto(FALSE);
}
if ($is_https) {
$base_url = securepages_baseurl();
}
}
function securepages_goto($secure) {
$url['path'] = drupal_is_front_page() ? '' : $_GET['q'];
$url['query'] = $_GET;
unset($url['query']['q']);
$url['https'] = $secure;
$url['base_url'] = securepages_baseurl($secure);
$url['absolute'] = TRUE;
$url['external'] = FALSE;
if (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
return;
}
else {
drupal_set_header('Location: ' . url($url['path'], $url));
drupal_set_header('Status: ' . '302 Found');
drupal_page_footer();
exit;
}
}
function securepages_match($path) {
$is_https = securepages_is_secure();
$secure = variable_get('securepages_secure', 1);
$pages = drupal_strtolower(variable_get('securepages_pages', SECUREPAGES_PAGES));
$ignore = drupal_strtolower(variable_get('securepages_ignore', SECUREPAGES_IGNORE));
$path = securepages_strtolower(trim($path, '/'));
if ($ignore) {
if (drupal_match_path($path, $ignore)) {
return $is_https ? 1 : 0;
}
}
if ($pages) {
$result = drupal_match_path($path, $pages);
if (function_exists('drupal_get_path_alias')) {
$path_alias = drupal_get_path_alias($path);
$result |= drupal_match_path($path_alias, $pages);
}
return !($secure xor $result) ? 1 : 0;
}
else {
return;
}
}
function securepages_roles($account) {
$roles = array_filter(variable_get('securepages_roles', array()));
$matches = array_intersect_key($account->roles, $roles);
return count($matches);
}
function securepages_test() {
$is_https = securepages_is_secure();
if ($is_https) {
return TRUE;
}
$url = 'https://' . preg_replace(';^http[s]?://;s', '', url('admin/build/securepages/test', array(
'absolute' => TRUE,
)));
$response = drupal_http_request($url);
return $response->code == 200 ? TRUE : FALSE;
}
function securepages_is_secure() {
return isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
}
function securepages_baseurl($secure = TRUE) {
global $base_url;
if ($secure) {
$url = variable_get('securepages_basepath_ssl', NULL);
}
else {
$url = variable_get('securepages_basepath', NULL);
}
if (!empty($url)) {
return $url;
}
return preg_replace('/http[s]?:\\/\\//i', $secure ? 'https://' : 'http://', $base_url, 1);
}
function securepages_strtolower($text) {
global $multibyte;
if ($multibyte == 1) {
return mb_strtolower($text);
}
else {
$text = strtolower($text);
$text = preg_replace_callback('/\\xC3[\\x80-\\x96\\x98-\\x9E]/', '_securepages_unicode_caseflip', $text);
return $text;
}
}
function _securepages_unicode_caseflip($matches) {
return $matches[0][0] . chr(ord($matches[0][1]) ^ 32);
}
function securepages_can_alter_url($url) {
global $base_path, $base_url;
$url = @parse_url($url);
if (!isset($url['scheme']) && $base_path == '/') {
return TRUE;
}
if (isset($url['host']) && strtolower($url['host']) != strtolower($_SERVER['HTTP_HOST'])) {
return FALSE;
}
if (strlen($base_path) > 1 && substr($base_url, -1) != substr($url['path'], 1, strlen($base_path))) {
return FALSE;
}
return TRUE;
}