Index: /extensions/Force_HTTPS/README.txt
===================================================================
--- /extensions/Force_HTTPS/README.txt	(revision 22560)
+++ /extensions/Force_HTTPS/README.txt	(revision 22560)
@@ -0,0 +1,9 @@
+piwigo-force-https
+------------------
+
+Force HTTPS (piwigo-force-https) is a security plugin for Piwigo.
+It allows administrators to force usage of SSL transport layer when browsing Piwigo.
+
+On https enabled web servers, http requests are automatically redirected to https requests.
+Https requests are secured using STS (Strict Transport Security). 
+For web browsers compatibility, please consult http://caniuse.com/stricttransportsecurity
Index: /extensions/Force_HTTPS/admin.php
===================================================================
--- /extensions/Force_HTTPS/admin.php	(revision 22560)
+++ /extensions/Force_HTTPS/admin.php	(revision 22560)
@@ -0,0 +1,87 @@
+<?php
+/***********************************************
+* File      :   admin.php
+* Project   :   piwigo-force-https
+* Descr     :   Generate the admin panel
+*
+* Created   :   02.05.2013
+* Updated   :   04.05.2013
+* Author: bonhommedeneige
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*
+************************************************/
+
+/**
+Changelog :
+ 1.1.0 (03.05.2013) : No change yet
+ 1.0.0 (02.05.2013) : Initial version 
+*/
+
+// Check whether we are indeed included by Piwigo.
+if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
+
+// Setup plugin Language
+load_language('plugin.lang', FORCE_HTTPS_PATH);
+
+// Fetch the template.
+global $template, $conf, $lang;
+
+
+// Test URL
+$tpl_test_https_url = "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
+
+// Load parameter
+$tpl_use_https = $conf['fhp_use_https'] ? 'true' : 'false';
+$tpl_use_sts = $conf['fhp_use_sts'] ? 'true' : 'false';
+
+// Update conf if submitted in admin site
+if (isset($_POST['submit']) && !empty($_POST['fhp_use_https']))
+{
+	$query = "UPDATE ". CONFIG_TABLE ." SET value='". $_POST['fhp_use_https'] ."' WHERE param='fhp_use_https'";
+	pwg_query($query);
+
+	// keep the value in the admin form
+	$tpl_use_https = $_POST['fhp_use_https'];
+}
+
+// Update conf if submitted in admin site
+if (isset($_POST['submit']) && !empty($_POST['fhp_use_sts']))
+{
+	$query = "UPDATE ". CONFIG_TABLE ." SET value='". $_POST['fhp_use_sts'] ."' WHERE param='fhp_use_sts'";
+	pwg_query($query);
+
+	// keep the value in the admin form
+	$tpl_use_sts = $_POST['fhp_use_sts'];
+}
+
+// send value to template
+$template->assign(
+	array(
+		'TPL_USE_HTTPS'			=> $tpl_use_https,
+		'TPL_USE_STS'           => $tpl_use_sts,
+		'TPL_TEST_URL'          => $tpl_test_https_url
+	)
+);
+
+// Add our template to the global template
+$template->set_filenames(
+	array(
+		'plugin_admin_content' => dirname(__FILE__).'/admin.tpl'
+	) 
+);
+
+// Assign the template contents to ADMIN_CONTENT
+$template->assign_var_from_handle('ADMIN_CONTENT', 'plugin_admin_content');
+?>
Index: /extensions/Force_HTTPS/admin.tpl
===================================================================
--- /extensions/Force_HTTPS/admin.tpl	(revision 22560)
+++ /extensions/Force_HTTPS/admin.tpl	(revision 22560)
@@ -0,0 +1,50 @@
+<div class="titrePage">
+  <h2>Force HTTPS plugin</h2>
+</div>
+<fieldset>
+<div style="text-align:left">
+	<p><b>{'fhp_about'|@translate}</b></p>
+	<p>{'fhp_description'|@translate}</p>
+</div>
+</fieldset>
+
+<form method="post" action="" class="properties">
+	<fieldset>
+		<legend>{'fhp_security_group'|@translate}</legend>
+		<table align="left">
+			<tr valign="top">
+				<td colspan="4">
+					<label>{'fhp_force_https_warning'|@translate}</label><br/>
+					<a href="{$TPL_TEST_URL}" onclick="window.open('{$TPL_TEST_URL}','popup','width=800,height=500,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false">{'fhp_test_https_link'|@translate}</a>
+				</td>
+			</tr>
+			<tr>
+				<td colspan="4"></td>
+			</tr>
+			<tr valign="top">
+				<td width="125" nowrap="nowrap"><label>{'fhp_force_https_label'|@translate} : </label></td>
+				<td nowrap="nowrap">{html_radios name='fhp_use_https' values='true,false'|@explode output='Yes,No'|@explode|translate selected=$TPL_USE_HTTPS}</td>
+				<td>&nbsp;</td>
+				<td><label>{'fhp_force_https_comment'|@translate}</label>
+				</td>
+			</tr>
+		</table>		
+	</fieldset>
+	<fieldset>
+		<legend>{'fhp_options_group'|@translate}</legend>
+		<table align="left">
+			<tr valign="top">
+				<td width="125" nowrap="nowrap"><label>{'fhp_activate_sts_label'|@translate} : </td>
+				<td nowrap="nowrap">{html_radios name='fhp_use_sts' values='true,false'|@explode output='Yes,No'|@explode|translate selected=$TPL_USE_STS}</td>
+				<td>&nbsp;</td>
+				<td><label>{'fhp_activate_sts_comment'|@translate}</label></td>
+			</tr>
+			<tr>
+				<td colspan="4"></td>
+			</tr>
+		</table>		
+	</fieldset>
+	<fieldset>
+		<input class="submit" type="submit" value="{'fhp_submit'|@translate}" name="submit"/>
+	</fieldset>
+</form>
Index: /extensions/Force_HTTPS/include/index.php
===================================================================
--- /extensions/Force_HTTPS/include/index.php	(revision 22560)
+++ /extensions/Force_HTTPS/include/index.php	(revision 22560)
@@ -0,0 +1,7 @@
+<?php
+$url = '../';
+header( 'Request-URI: '.$url );
+header( 'Content-Location: '.$url );
+header( 'Location: '.$url );
+exit();
+?>
Index: /extensions/Force_HTTPS/index.php
===================================================================
--- /extensions/Force_HTTPS/index.php	(revision 22560)
+++ /extensions/Force_HTTPS/index.php	(revision 22560)
@@ -0,0 +1,7 @@
+<?php
+$url = '../';
+header( 'Request-URI: '.$url );
+header( 'Content-Location: '.$url );
+header( 'Location: '.$url );
+exit();
+?>
Index: /extensions/Force_HTTPS/language/en_UK/index.php
===================================================================
--- /extensions/Force_HTTPS/language/en_UK/index.php	(revision 22560)
+++ /extensions/Force_HTTPS/language/en_UK/index.php	(revision 22560)
@@ -0,0 +1,7 @@
+<?php
+$url = '../';
+header( 'Request-URI: '.$url );
+header( 'Content-Location: '.$url );
+header( 'Location: '.$url );
+exit();
+?>
Index: /extensions/Force_HTTPS/language/en_UK/plugin.lang.php
===================================================================
--- /extensions/Force_HTTPS/language/en_UK/plugin.lang.php	(revision 22560)
+++ /extensions/Force_HTTPS/language/en_UK/plugin.lang.php	(revision 22560)
@@ -0,0 +1,23 @@
+<?php
+$lang['fhp_about'] = 'About';
+$lang['fhp_description'] = 'This plugin fills a security gap in Piwigo. It allows administrators to force the usage of SSL secured connections for browsing Piwigo (when https is available on the hosting server).
+<br>It is highly recommend to use secured connections to protect user and password transmissions.
+';
+
+$lang['fhp_security_group'] = 'Security settings';
+$lang['fhp_options_group'] = 'Options';
+$lang['fhp_force_https_label'] = 'Force HTTPS';
+$lang['fhp_force_https_comment'] = 'Active this option to force clients to connect Piwigo through a secured connection.';
+$lang['fhp_force_https_warning'] = '<b>Warning !</b> Before activating secured connection, please verify your server supports https. You can click on the following link to test (loads this page in https mode).';
+$lang['fhp_test_https_link'] = 'Test this page in https (popup window)';
+$lang['fhp_activate_sts_label'] = 'Use STS';
+$lang['fhp_activate_sts_comment'] = 'Active HTTP Strict Transport Security (HSTS)<br/>
+									This option must be activated if you own a signed TLS certficate. It has no effect if "Force HTTPS" is turned off<br/><br/>
+									<i>HSTS is a web security mechanism whereby the web server declares the web browser to interact with it only using secure HTTPS connections.
+									When HSTS is active, a header field "Strict-Transport-Security" is placed in http header, and any site link is automatically replaced with a secured link.<br/>
+									</i>';
+$lang['fhp_sts_maxage_label'] = 'STS max-age';
+$lang['fhp_sts_maxage_comment'] = 'STS max-age in seconds';
+
+$lang['fhp_submit'] = 'Submit';
+?>
Index: /extensions/Force_HTTPS/language/fr_FR/index.php
===================================================================
--- /extensions/Force_HTTPS/language/fr_FR/index.php	(revision 22560)
+++ /extensions/Force_HTTPS/language/fr_FR/index.php	(revision 22560)
@@ -0,0 +1,7 @@
+<?php
+$url = '../';
+header( 'Request-URI: '.$url );
+header( 'Content-Location: '.$url );
+header( 'Location: '.$url );
+exit();
+?>
Index: /extensions/Force_HTTPS/language/fr_FR/plugin.lang.php
===================================================================
--- /extensions/Force_HTTPS/language/fr_FR/plugin.lang.php	(revision 22560)
+++ /extensions/Force_HTTPS/language/fr_FR/plugin.lang.php	(revision 22560)
@@ -0,0 +1,24 @@
+<?php
+$lang['fhp_about'] = 'A propos';
+$lang['fhp_description'] = 'Ce plugin comble une fonctionnalité indispensable à Piwigo et permet de forcer l\'utilisation de connexions sécurisées par SSL dans Piwigo, quand celles-ci sont disponibles sur le serveur hébergeant l\'application.
+<br>Il est fortement recommandé d\'utiliser des connexions sécurisées pour protéger les transmissions de votre nom d\'utilisateur et mot de passe.
+';
+
+$lang['fhp_security_group'] = 'Gestion de la sécurité';
+$lang['fhp_options_group'] = 'Options';
+$lang['fhp_force_https_label'] = 'Forcer HTTPS';
+$lang['fhp_force_https_comment'] = 'Activer cette option pour forcer les clients à se connecter à Piwigo via une connexion chiffrée.';
+$lang['fhp_force_https_warning'] = '<b>Attention !</b> Avant d\'activer la connexion chiffrée, veuillez vérifier que votre serveur peut être accédé via https en cliquant sur le lien ci-après (affichage de cette même page en https).';
+$lang['fhp_test_https_link'] = 'Tester cette page en https (popup)';
+$lang['fhp_activate_sts_label'] = 'Utiliser STS';
+$lang['fhp_activate_sts_comment'] = 'Activer HTTP Strict Transport Security (HSTS)<br/>
+									Cette option doit être activée si vous utilisez un certificat TLS/SSL signé par une autorité valide (sans effet si "Forcer HTTPS" est désactivée)<br/><br/>
+									<i>HSTS est un mécanisme de sécurité permettant de déclarer au navigateur web qu\'il doit interagir avec
+									le serveur en utilisant une connexion sécurisée (https).
+									Lorsque la politique HSTS est active, un champ en-tête "Strict-Transport-Security" est ajouté dans les requêtes, et tous les liens d\'un site sont alors automatiquement remplacés par des liens sécurisés.<br/>
+									</i>';
+$lang['fhp_sts_maxage_label'] = 'STS max-age';
+$lang['fhp_sts_maxage_comment'] = 'STS max-age en secondes';
+
+$lang['fhp_submit'] = 'Enregistrer';
+?>
Index: /extensions/Force_HTTPS/language/index.php
===================================================================
--- /extensions/Force_HTTPS/language/index.php	(revision 22560)
+++ /extensions/Force_HTTPS/language/index.php	(revision 22560)
@@ -0,0 +1,7 @@
+<?php
+$url = '../';
+header( 'Request-URI: '.$url );
+header( 'Content-Location: '.$url );
+header( 'Location: '.$url );
+exit();
+?>
Index: /extensions/Force_HTTPS/main.inc.php
===================================================================
--- /extensions/Force_HTTPS/main.inc.php	(revision 22560)
+++ /extensions/Force_HTTPS/main.inc.php	(revision 22560)
@@ -0,0 +1,146 @@
+<?php 
+/*
+Plugin Name: Force HTTPS
+Version: 1.2.0
+Description: Gives the capacity to force https connections on https enabled servers.
+Plugin URI: http://piwigo.org/ext/extension_view.php?eid=697
+Author: bonhommedeneige
+Author URI: http://piwigo.org/forum/profile.php?id=19052
+
+Changelog :
+ 1.2.0 (05.05.2013) : Fixed unicity of strbool function (renamed to piwigo_force_https_strbool)
+                      Caused unicity issue with video-js plugin
+ 1.1.0 (04.05.2013) : Added response code 301 before redirecting to https
+					  Added capacity to activate or not HSTS
+ 					  Corrected initialization of configuration at first launch
+ 1.0.0 (02.05.2013) : Initial version 
+*/
+
+defined('PHPWG_ROOT_PATH') or die('Hacking attempt!');
+
+global $conf;
+
+// +-----------------------------------------------------------------------+
+// | Define plugin constants                                               |
+// +-----------------------------------------------------------------------+
+define('FORCE_HTTPS_ID', basename(dirname(__FILE__)));
+define('FORCE_HTTPS_PATH' ,   PHPWG_PLUGINS_PATH . FORCE_HTTPS_ID . '/');
+define('FORCE_HTTPS_VERSION', '1.2.0');
+// this is automatically updated by PEM if you publish your plugin with SVN, otherwise you musn't forget to change it, as well as "Version" in the plugin header
+
+
+// +-----------------------------------------------------------------------+
+// | Add event handlers                                                    |
+// +-----------------------------------------------------------------------+
+// init the plugin
+add_event_handler('init', 'piwigo_force_https_init');
+
+if (defined('IN_ADMIN'))
+{
+  // admin plugins menu link
+  add_event_handler('get_admin_plugin_menu_links', 'piwigo_force_https_admin_plugin_menu_links');
+}
+
+add_event_handler('loc_end_page_header', 'piwigo_force_https_header' );
+
+/**
+ * Admin plugins menu link
+ */
+function piwigo_force_https_admin_plugin_menu_links($menu) 
+{
+  array_push($menu, array(
+    'NAME' => l10n('Force HTTPS'),
+    'URL' => get_admin_plugin_menu_link(dirname(__FILE__).'/admin.php'),
+  ));
+  return $menu;
+}
+
+/**
+ * plugin initialization
+ *   - check for upgrades
+ *   - unserialize configuration
+ *   - load language
+ */
+function piwigo_force_https_init()
+{
+  global $conf, $pwg_loaded_plugins;
+  
+  // apply upgrade if needed
+  if (
+    FORCE_HTTPS_VERSION == 'auto' or
+    $pwg_loaded_plugins[FORCE_HTTPS_ID]['version'] == 'auto' or
+    version_compare($pwg_loaded_plugins[FORCE_HTTPS_ID]['version'], FORCE_HTTPS_VERSION, '<')
+  )
+  {
+    // call install function
+    include_once(FORCE_HTTPS_PATH . 'maintain.inc.php');
+    plugin_install();
+    
+    // update plugin version in database
+    if ( $pwg_loaded_plugins[FORCE_HTTPS_ID]['version'] != 'auto' and FORCE_HTTPS_VERSION != 'auto' )
+    {
+      $query = '
+		UPDATE '. PLUGINS_TABLE .'
+		SET version = "'. FORCE_HTTPS_VERSION .'"
+		WHERE id = "'. FORCE_HTTPS_ID .'"';
+      pwg_query($query);
+      
+      $pwg_loaded_plugins[FORCE_HTTPS_ID]['version'] = FORCE_HTTPS_VERSION;
+      
+      if (defined('IN_ADMIN'))
+      {
+        $_SESSION['page_infos'][] = 'Force https updated to version '. FORCE_HTTPS_VERSION;
+      }
+    }
+  }
+  
+  // prepare plugin configuration
+  //$conf['piwigo_force_https'] = unserialize($conf['piwigo_force_https']);
+}
+
+/**
+ * SSL availability check
+ *   - function checks if ssl is available on domain
+ */
+function piwigo_force_https_checkssl() {
+	global $conf;
+	
+$mylinks="http://www.petitssuisses.com";
+$handlerr = curl_init($mylinks);
+curl_setopt($handlerr,  CURLOPT_RETURNTRANSFER, TRUE);
+$resp = curl_exec($handlerr);
+$ht = curl_getinfo($handlerr, CURLINFO_HTTP_CODE);
+
+if ($ht == '404')
+     { echo 'OK';}
+else { echo 'NO';
+}
+}
+
+/**
+ * Http connections control
+ * - function completes http header based on configuration settings
+ */
+function piwigo_force_https_header() {
+	global $conf;
+
+	// Force https connection
+	$use_https = isset($conf['fhp_use_https']) ? piwigo_force_https_strbool($conf['fhp_use_https']) : 'false';
+	$use_sts = isset($conf['fhp_use_sts']) ? piwigo_force_https_strbool($conf['fhp_use_sts']) : 'false';
+
+	// Activates STS security
+	if ($use_https == 'true') {
+		if ($use_sts == 'true' && isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
+		  header('Strict-Transport-Security: max-age=500');
+		} elseif (!isset($_SERVER['HTTPS'])) {
+		  header('Status-Code: 301');
+		  header('Location: https://'.$_SERVER["HTTP_HOST"].$_SERVER['REQUEST_URI']);
+		}
+	}
+}
+
+function piwigo_force_https_strbool($value)
+{
+	return $value ? 'true' : 'false';
+}
+?>
Index: /extensions/Force_HTTPS/maintain.inc.php
===================================================================
--- /extensions/Force_HTTPS/maintain.inc.php	(revision 22560)
+++ /extensions/Force_HTTPS/maintain.inc.php	(revision 22560)
@@ -0,0 +1,96 @@
+<?php
+/***********************************************
+* File      :   maintain.inc.php
+* Project   :   piwigo-force-https
+* Descr     :   Install / Uninstall method
+*
+* Created   :   02.05.2013
+* Updated   :   03.05.2013
+* Author    :   bonhommedeneige
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*
+************************************************/
+
+/**
+Changelog :
+ 1.2.0 (05.05.2013) : No change
+ 1.1.0 (04.05.2013) : Added HSTS security settings
+                      Modified default values at initialization (disabled by default)
+ 1.0.0 (02.05.2013) : Initial version 
+*/
+
+if (!defined('PHPWG_ROOT_PATH')) die('Hacking attempt!');
+define('FORCE_HTTPS_PATH' , PHPWG_PLUGINS_PATH . basename(dirname(__FILE__)) . '/');
+
+function plugin_install()
+{
+	$q = 'INSERT INTO '.CONFIG_TABLE.' (param,value,comment)
+		VALUES ("fhp_use_https", "false", "https usage status tag used by the piwigo-force-https plugin");';
+	pwg_query( $q );
+	
+	$q = 'INSERT INTO '.CONFIG_TABLE.' (param,value,comment)
+		VALUES ("fhp_use_sts", "false", "HTTP Strict Transport Security (HSTS) usage status tag used by the piwigo-force-https plugin");';
+	pwg_query( $q );
+	
+	$q = 'INSERT INTO '.CONFIG_TABLE.' (param,value,comment)
+		VALUES ("fhp_sts_maxage", "500", "max age duration (in seconds) used by the piwigo-force-https plugin");';
+	pwg_query( $q );
+}
+
+function plugin_uninstall()
+{
+	if (is_dir(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'piwigo-force-https'))
+	{
+		deltree(PHPWG_ROOT_PATH.PWG_LOCAL_DIR.'piwigo-force-https');
+	}
+	$q = 'DELETE FROM '.CONFIG_TABLE.' WHERE param LIKE "fhp_%" LIMIT 6;';
+	pwg_query( $q );
+}
+
+function plugin_activate()
+{
+	global $conf;
+
+	if (!isset($conf['fhp_use_https']))
+	{
+		plugin_install();
+	}
+}
+
+function deltree($path)
+{
+	if (is_dir($path))
+	{
+		$fh = opendir($path);
+		while ($file = readdir($fh))
+		{
+			if ($file != '.' and $file != '..')
+			{
+				$pathfile = $path . '/' . $file;
+				if (is_dir($pathfile))
+				{
+					deltree($pathfile);
+				}
+				else
+				{
+					@unlink($pathfile);
+				}
+			}
+		}
+		closedir($fh);
+		return @rmdir($path);
+	}
+}
+?>
Index: /extensions/Force_HTTPS/pem_metadata.txt
===================================================================
--- /extensions/Force_HTTPS/pem_metadata.txt	(revision 22560)
+++ /extensions/Force_HTTPS/pem_metadata.txt	(revision 22560)
@@ -0,0 +1,4 @@
+File automatically created from SVN repository.
+
+URL: 
+Revision: 
