From 2dd0900cd5c2adb610fd35e10133dd9fc10ca0f9 Mon Sep 17 00:00:00 2001 From: M Date: Tue, 8 Dec 2015 19:21:46 -0500 Subject: + Added controller security assertions: require_https and forbid_https --- app/class/controller.class.php | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'app/class/controller.class.php') diff --git a/app/class/controller.class.php b/app/class/controller.class.php index 4ea40d1..fabd7e7 100644 --- a/app/class/controller.class.php +++ b/app/class/controller.class.php @@ -12,6 +12,26 @@ abstract class Controller extends Framework * Abstract function for concrete controller to handle the page request */ abstract function handle($argv); + + /* + * Security check + * Assert that the current connection to this server is secure. Redirects if not. + */ + function sec_require_https() + { + if (!isset($_SERVER['HTTPS'])) + $this->redirectTo("https://" . $_SERVER['SERVER_NAME'] . $this->ap()); + } + + /* + * Security check + * Assert that the current connection to this server is NOT secure. Redirects if not. + */ + function sec_forbid_https() + { + if (isset($_SERVER['HTTPS'])) + $this->redirectTo("http://" . $_SERVER['SERVER_NAME'] . $this->ap()); + } } ?> -- cgit v1.2.3