LP88653 force SSL for requests from local XUL

Modifies RemoteRequest.js to convert any http:// request URL to https:// if the
requesting location has a chrome:// protocol.

Modifies util/network.js such that any use of util.network.request (as opposed
to util.network.simple_request) will assume "secure" for the resulting request.

Adds an example to the bottom of eg_vhost.conf for forcing SSL for an entire
site (OPAC and everything), courtesy of Dan Wells.

Signed-off-by: Jason Etheridge <jason@esilibrary.com>
Signed-off-by: Dan Wells <dbw2@calvin.edu>

diff --git a/Open-ILS/examples/apache/eg_vhost.conf b/Open-ILS/examples/apache/eg_vhost.conf
index 7fea97c..baf0b64 100644 (file)
--- a/Open-ILS/examples/apache/eg_vhost.conf
+++ b/Open-ILS/examples/apache/eg_vhost.conf
@@ -600,3 +600,8 @@ RewriteRule ^/openurl$ ${openurl:%1} [NE,PT]
         </IfModule>
     </IfModule>
 </Location>
+
+# Uncomment the following to force SSL for everything. Note that this defeats caching
+# and you will suffer a performance hit.
+#RewriteCond %{HTTPS} off
+#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]

diff --git a/Open-ILS/web/opac/common/js/RemoteRequest.js b/Open-ILS/web/opac/common/js/RemoteRequest.js
index 125f57a..ae43f11 100644 (file)
--- a/Open-ILS/web/opac/common/js/RemoteRequest.js
+++ b/Open-ILS/web/opac/common/js/RemoteRequest.js
@@ -213,7 +213,7 @@ RemoteRequest.prototype.send = function(blocking) {
                        url = 'http://'+XML_HTTP_SERVER+'/'+XML_HTTP_GATEWAY;
 
                if( url.match(/^http:/) && 
-                               (this.secure || location.href.match(/^https:/)) ) {
+                               (this.secure || location.href.match(/^https:/) || location.href.match(/^chrome:/) ) ) {
                        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
                        url = url.replace(/^http:/, 'https:');
                }

diff --git a/Open-ILS/xul/staff_client/chrome/content/util/network.js b/Open-ILS/xul/staff_client/chrome/content/util/network.js
index 4fcca50..dd4828b 100644 (file)
--- a/Open-ILS/xul/staff_client/chrome/content/util/network.js
+++ b/Open-ILS/xul/staff_client/chrome/content/util/network.js
@@ -74,7 +74,12 @@ util.network.prototype = {
         //obj.error.sdump('D_SES','request '+ app + ' ' + name +' '+obj.error.pretty_print(sparams.slice(1,sparams.length-1))+
         //    '\noverride_params = ' + override_params + '\n_params = ' + _params + '\n');
 
-        try { 
+        try {
+
+            if (typeof _params == 'undefined') {
+                // If we're not using simple_request to get here, let's assume secure by default
+                _params = { 'secure' : true };
+            }
 
             var request =  this._request(app,name,params,f,override_params,_params);
             if (request) {