Yeah, this seems like a ratehr gaping security hole.  I don't want to force all visitors to use ssl, but I'd like the registration and login forms to be submitted over https, but the form's just submit over the originating protocol, so if the visitor comes in using http, their password will be sent in the clear!

To configure SSL for website

Complete the following steps:

1 In Internet Explorer, go to Tools -> Internet Options.
2    Click on the Advanced tab and scroll to the bottom of the screen.
3    Place a checkmark in the boxes next to:

       * Use SSL 2.0
       * Use SSL 3.0 

4    Click Apply.
5    Click OK.
6    Refresh your window by clicking Refresh or by pressing F5.


Mozilla Firefox

   1.  Go to Tools -> Options.
   2   Click Advanced.
   3   Go to the Encryption Tab.
   4   Check the box next to Use SSL 3.0.
   5   Click OK.
   6   Refresh your window by clicking Refresh or by pressing F5.

Hi everyone, especially the piwigo team,

I want to bring this item back on the table. Of course, Piwigo runs fine over https, that is not the question. But we that is not what most people want.

What would be nice is a feature that normal visitors browse over http, while if you login or doing admin stuff, https is used.

Wordpress has a similar feature, see http://codex.wordpress.org/Administration_Over_SSL which redirects one automatically to https when logging in and all the admin stuff (separate settings).

This is a feature that I consider of great importance.

I looked into the source accoring to the work around mentioned in http://piwigo.org/bugs/print_bug_page.php?bug_id=2689, but the code has changed and now uses get_root_url function. Maybe it is enough to make some changes there to switch to https scheme as soon as one tries to login and/or administer.

Thanks for reconsidering this item

Norbert

Hi,

bonhommedeneige wrote:

I've called the plugin "Force HTTPS"

that is already a nice step forward, but I would like to have HTTPS only for admins, registered users, and maybe only for the login process, but not for the actual browsing.

Do you think that this is doable in your plugin?

I checked the code a bit and it seems that you just give a redirect header, which is ok, but not optimal for differentiation.

Anyway, thanks first of all for your work on that and the nice plugin.

Norbert

Try using mod_rewrite to force the administration.php file to be redirected to HTTPS.  This forces the login process to be encrypted, but lets people browse without SSL.

Hello ;
trying to make the https in my piwigo page i downloaded the plugin "force https" but don't know how to make it work ?!
Any help Guys ? : )