diff --git a/config/global.ini.php b/config/global.ini.php index fc3ddb19637796d668267a4bbc92c621525b1138..7e5ef14a51e14fa4cf46817c26f40fc612cd6f69 100644 --- a/config/global.ini.php +++ b/config/global.ini.php @@ -164,6 +164,12 @@ session_save_handler = files ; If set to 1, Piwik redirects the login form to use a secure connection (i.e., https). force_ssl_login = 0 +; If set to 1, Piwik will automatically redirect all http:// requests to https:// +; If SSL / https is not correctly configured on the server, this will break Piwik +; If you set this to 1, and your SSL configuration breaks later on, you can always edit this back to 0 +; it is recommended for security reasons to always use Piwik over https +force_ssl = 1 + ; login cookie name login_cookie_name = piwik_auth diff --git a/core/FrontController.php b/core/FrontController.php index e635d5374f7bf000c2fdf79a68ef5d898f83bd27..f343baca8f72fa5fdf4dd6ee920b3ace6b736d2d 100644 --- a/core/FrontController.php +++ b/core/FrontController.php @@ -254,6 +254,16 @@ class Piwik_FrontController exit; } + + if(Zend_Registry::get('config')->General->force_ssl == 1 + && !Piwik::isHttps()) + { + $url = Piwik_Url::getCurrentUrl(); + $url = str_replace("http://", "https://", $url); + Piwik_Url::redirectToUrl($url); + } + + $pluginsManager = Piwik_PluginsManager::getInstance(); $pluginsToLoad = Zend_Registry::get('config')->Plugins->Plugins->toArray(); $pluginsManager->loadPlugins( $pluginsToLoad ); diff --git a/plugins/Login/Controller.php b/plugins/Login/Controller.php index f72d56a36b81ee77ffcc75f15f2ea02ce659e67a..4105603b83f15739debbd51190b534a77ffce0c7 100644 --- a/plugins/Login/Controller.php +++ b/plugins/Login/Controller.php @@ -465,16 +465,14 @@ class Piwik_Login_Controller extends Piwik_Controller protected function checkForceSslLogin() { $forceSslLogin = Zend_Registry::get('config')->General->force_ssl_login; - if($forceSslLogin) + if($forceSslLogin + && !Piwik::isHttps()) { - if(!Piwik::isHttps()) - { - $url = 'https://' - . Piwik_Url::getCurrentHost() - . Piwik_Url::getCurrentScriptName() - . Piwik_Url::getCurrentQueryString(); - Piwik_Url::redirectToUrl($url); - } + $url = 'https://' + . Piwik_Url::getCurrentHost() + . Piwik_Url::getCurrentScriptName() + . Piwik_Url::getCurrentQueryString(); + Piwik_Url::redirectToUrl($url); } } }