From 04c23a9c8782132ad0c0817848b695db4735824d Mon Sep 17 00:00:00 2001
From: ozhozh <ozhozh@12232710-3e20-11de-b438-597f59cd7555>
Date: Tue, 29 Dec 2009 15:53:11 +0000
Subject: [PATCH] Improved: all admin URLs handled by function
 yourls_admin_url(), which allows SSL enforcement (new const
 YOURLS_ADMIN_SSL). Fixes issue 190.

git-svn-id: http://yourls.googlecode.com/svn/trunk@257 12232710-3e20-11de-b438-597f59cd7555
---
 admin/index.php             |  4 ++--
 admin/index_ajax.php        |  1 +
 admin/install.php           |  4 ++--
 admin/tools.php             |  6 ++---
 admin/upgrade.php           |  6 ++---
 includes/functions-html.php |  6 ++---
 includes/functions.php      | 47 ++++++++++++++++++++++++++++++-------
 includes/load-yourls.php    | 13 ++++++++++
 yourls-infos.php            |  2 +-
 9 files changed, 67 insertions(+), 22 deletions(-)

diff --git a/admin/index.php b/admin/index.php
index 009a114..64681eb 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -1,5 +1,5 @@
 <?php
-// Require Files
+define( 'YOURLS_ADMIN', true );
 require_once( dirname(dirname(__FILE__)).'/includes/load-yourls.php' );
 yourls_maybe_require_auth();
 
@@ -24,7 +24,7 @@
 } else {
 	$link_filter = '';
 }
-$base_page = YOURLS_SITE . '/admin/index.php';
+$base_page = yourls_admin_url( 'index.php' );
 
 // Searching
 if(!empty($search) && !empty($_GET['s_in'])) {
diff --git a/admin/index_ajax.php b/admin/index_ajax.php
index 9191f1a..adb3290 100644
--- a/admin/index_ajax.php
+++ b/admin/index_ajax.php
@@ -1,5 +1,6 @@
 <?php
 define('YOURLS_AJAX', true);
+define('YOURLS_ADMIN', true);
 require_once( dirname(dirname(__FILE__)).'/includes/load-yourls.php' );
 yourls_maybe_require_auth();
 
diff --git a/admin/install.php b/admin/install.php
index d8c0b23..fd8d4b6 100644
--- a/admin/install.php
+++ b/admin/install.php
@@ -1,6 +1,6 @@
 <?php
-// Require Files
 define( 'YOURLS_INSTALLING', true );
+define( 'YOURLS_ADMIN', true );
 require_once( dirname(dirname(__FILE__)).'/includes/load-yourls.php' );
 require_once( dirname(dirname(__FILE__)).'/includes/functions-install.php' );
 
@@ -66,7 +66,7 @@
 				echo '<p>&nbsp;</p><p style="text-align: center;"><input type="submit" name="install" value="Install YOURLS" class="button" /></p>';
 			} else {
 				if( count($error) == 0 )
-					echo '<p>&nbsp;</p><p style="text-align: center;">&raquo; <a href="'.YOURLS_SITE.'/admin/" title="YOURS Administration Page">YOURS Administration Page</a></p>';
+					echo '<p>&nbsp;</p><p style="text-align: center;">&raquo; <a href="'.yourls_admin_url().'" title="YOURS Administration Page">YOURS Administration Page</a></p>';
 			}
 		?>
 	</form>
diff --git a/admin/tools.php b/admin/tools.php
index 1f9d610..5370fab 100644
--- a/admin/tools.php
+++ b/admin/tools.php
@@ -1,5 +1,5 @@
 <?php
-// Require Files
+define( 'YOURLS_ADMIN', true );
 require_once( dirname(dirname(__FILE__)).'/includes/load-yourls.php' );
 yourls_maybe_require_auth();
 
@@ -26,11 +26,11 @@
 		
 		<ul>
 			<li><h3>Simple bookmarklet</h3>
-			Click and drag the link to your toolbar: <a href="javascript:var%20d=document,w=window,enc=encodeURIComponent,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),s2=((s.toString()=='')?s:enc(s)),f='<?php echo YOURLS_SITE; ?>/admin/index.php',l=d.location,p='?u='+enc(l.href)+'&t='+enc(d.title)+'&s='+s2,u=f+p;try%7Bthrow('ozhismygod');%7Dcatch(z)%7Ba=function()%7Bif(!w.open(u))l.href=u;%7D;if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();%7Dvoid(0);" class="bookmarklet" onclick="alert('Drag to your toolbar!');return false;">Shorten</a>
+			Click and drag the link to your toolbar: <a href="javascript:var%20d=document,w=window,enc=encodeURIComponent,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),s2=((s.toString()=='')?s:enc(s)),f='<?php echo yourls_admin_url('index.php'); ?>',l=d.location,p='?u='+enc(l.href)+'&t='+enc(d.title)+'&s='+s2,u=f+p;try%7Bthrow('ozhismygod');%7Dcatch(z)%7Ba=function()%7Bif(!w.open(u))l.href=u;%7D;if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();%7Dvoid(0);" class="bookmarklet" onclick="alert('Drag to your toolbar!');return false;">Shorten</a>
 			</li>
 		
 			<li><h3>Advanced bookmarklet (custom keyword)</h3>
-			Click and drag the link to your toolbar: <a href="javascript:var%20d=document,w=window,enc=encodeURIComponent,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),s2=((s.toString()=='')?s:('%22'+enc(s)+'%22')),f='<?php echo YOURLS_SITE; ?>/admin/index.php',l=d.location,k=prompt(%22Custom%20URL%22),k2=(k?'&k='+k:%22%22),p='?u='+enc(l.href)+'&t='+enc(d.title)+''+s2+k2,u=f+p;try%7Bthrow('ozhismygod');%7Dcatch(z)%7Ba=function()%7Bif(!w.open(u))l.href=u;%7D;if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();%7Dvoid(0)" class="bookmarklet" onclick="alert('Drag to your toolbar!');return false;">Custom shorten</a>
+			Click and drag the link to your toolbar: <a href="javascript:var%20d=document,w=window,enc=encodeURIComponent,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),s2=((s.toString()=='')?s:('%22'+enc(s)+'%22')),f='<?php echo yourls_admin_url('index.php'); ?>',l=d.location,k=prompt(%22Custom%20URL%22),k2=(k?'&k='+k:%22%22),p='?u='+enc(l.href)+'&t='+enc(d.title)+''+s2+k2,u=f+p;try%7Bthrow('ozhismygod');%7Dcatch(z)%7Ba=function()%7Bif(!w.open(u))l.href=u;%7D;if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();%7Dvoid(0)" class="bookmarklet" onclick="alert('Drag to your toolbar!');return false;">Custom shorten</a>
 			</li>
 		</ul>
 		
diff --git a/admin/upgrade.php b/admin/upgrade.php
index 4fc28d1..984c3a5 100644
--- a/admin/upgrade.php
+++ b/admin/upgrade.php
@@ -1,5 +1,5 @@
 <?php
-// Require Files
+define( 'YOURLS_ADMIN', true );
 define( 'YOURLS_NO_UPGRADE_CHECK', true ); // Bypass version checking to prevent loop
 require_once( dirname(dirname(__FILE__)).'/includes/load-yourls.php' );
 require_once( dirname(dirname(__FILE__)).'/includes/functions-upgrade.php' );
@@ -15,7 +15,7 @@
 
 // Check if upgrade is needed
 if ( !yourls_upgrade_is_needed() ) {
-	echo '<p>Upgrade not required. Go <a href="'.YOURLS_SITE.'/admin/index.php">back to play</a>!</p>';
+	echo '<p>Upgrade not required. Go <a href="'.yourls_admin_url('index.php').'">back to play</a>!</p>';
 
 
 } else {
@@ -73,7 +73,7 @@
 			
 		case 3:
 			$upgrade = yourls_upgrade( 3, $oldver, $newver, $oldsql, $newsql );
-			$admin = YOURLS_SITE.'/admin/index.php';
+			$admin = yourls_admin_url('index.php');
 			echo "
 			<p>Your installation is now up to date !</p>
 			<p>Go back to <a href='$admin'>the admin interface</a></p>
diff --git a/includes/functions-html.php b/includes/functions-html.php
index 63b89a9..37beaae 100644
--- a/includes/functions-html.php
+++ b/includes/functions-html.php
@@ -4,7 +4,7 @@
 function yourls_html_logo() {
 	?>
 	<h1>
-		<a href="<?php echo YOURLS_SITE; ?>/admin/index.php" title="YOURLS"><span>YOURLS</span>: <span>Y</span>our <span>O</span>wn <span>URL</span> <span>S</span>hortener<br/>
+		<a href="<?php echo yourls_admin_url('index.php') ?>" title="YOURLS"><span>YOURLS</span>: <span>Y</span>our <span>O</span>wn <span>URL</span> <span>S</span>hortener<br/>
 		<img src="<?php echo YOURLS_SITE; ?>/images/yourls-logo.png" alt="YOURLS" title="YOURLS" border="0" style="border: 0px;" /></a>
 	</h1>
 	<?php
@@ -284,8 +284,8 @@ function yourls_html_menu() {
 	<?php if ( yourls_is_private() ) { ?>
 		<li>Hello <strong><?php echo YOURLS_USER; ?></strong> (<a href="?mode=logout" title="Logout">Logout</a>)</li>
 	<?php } ?>
-		<li>Go to the <a href="<?php echo YOURLS_SITE; ?>/admin/index.php">Admin Interface</a></li>
-		<li>Check the <a href="<?php echo YOURLS_SITE; ?>/admin/tools.php">Tools</a></li>
+		<li>Go to the <a href="<?php echo yourls_admin_url('index.php') ?>">Admin Interface</a></li>
+		<li>Check the <a href="<?php echo yourls_admin_url('tools.php'); ?>">Tools</a></li>
 		<li>Read the <a href="<?php echo YOURLS_SITE; ?>/readme.html">Help</a></li>
 	</ul>
 	<?php
diff --git a/includes/functions.php b/includes/functions.php
index 207502d..7e1eec6 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -649,10 +649,6 @@ function yourls_get_user_agent() {
 
 // Redirect to another page
 function yourls_redirect( $location, $code = 301 ) {
-	// Anti fool check: cannot redirect to the URL we currently are on
-	if( preg_replace('!^[^:]+://!', '', $location) == $_SERVER["SERVER_NAME"].$_SERVER['REQUEST_URI'] )
-		return false;
-	
 	// Redirect, either properly if possible, or via Javascript otherwise
 	if( !headers_sent() ) {
 		yourls_status_header( $code );
@@ -1197,6 +1193,11 @@ function yourls_sanitize_version( $ver ) {
 	return preg_replace( '/[^0-9a-zA-Z-.]/', '', $ver );
 }
 
+// Converts keyword into short link
+function yourls_link( $keyword = '' ) {
+	return YOURLS_SITE . '/' . yourls_sanitize_keyword( $keyword );
+}
+
 // Check if we're in API mode. Returns bool
 function yourls_is_API() {
 	if ( defined('YOURLS_API') && YOURLS_API == true )
@@ -1225,7 +1226,37 @@ function yourls_has_interface() {
 	return true;
 }
 
-// Converts keyword into short link
-function yourls_link( $keyword = '' ) {
-	return YOURLS_SITE . '/' . yourls_sanitize_keyword( $keyword );
-}
\ No newline at end of file
+// Check if we're in the admin area. Returns bool
+function yourls_is_admin() {
+	if ( defined('YOURLS_ADMIN') && YOURLS_ADMIN == true )
+		return true;
+	return false;
+}
+
+// Check if SSL is required. Returns bool.
+function yourls_needs_ssl() {
+	if ( defined('YOURLS_ADMIN_SSL') && YOURLS_ADMIN_SSL == true )
+		return true;
+	return false;
+}
+
+// Return admin link, with SSL preference if applicable.
+function yourls_admin_url( $page = '' ) {
+	$admin = YOURLS_SITE . '/admin/' . $page;
+	if( defined('YOURLS_ADMIN_SSL') && YOURLS_ADMIN_SSL == true )
+		$admin = str_replace('http://', 'https://', $admin);
+	return $admin;
+}
+
+// Check if SSL is used, returns bool. Stolen from WP.
+function yourls_is_ssl() {
+	if ( isset($_SERVER['HTTPS']) ) {
+		if ( 'on' == strtolower($_SERVER['HTTPS']) )
+			return true;
+		if ( '1' == $_SERVER['HTTPS'] )
+			return true;
+	} elseif ( isset($_SERVER['SERVER_PORT']) && ( '443' == $_SERVER['SERVER_PORT'] ) ) {
+		return true;
+	}
+	return false;
+}
diff --git a/includes/load-yourls.php b/includes/load-yourls.php
index 881e092..2154b63 100644
--- a/includes/load-yourls.php
+++ b/includes/load-yourls.php
@@ -43,10 +43,23 @@
 	define( 'YOURLS_NONCE_LIFE', 3600 ); // life span of a nonce in seconds
 if( !defined('YOURLS_NOSTATS') )
 	define( 'YOURLS_NOSTATS', false ); // if set to true, disable stat logging (no use for it, too busy servers, ...)
+if( !defined('YOURLS_ADMIN_SSL') )
+	define( 'YOURLS_ADMIN_SSL', false ); // if set to true, force https:// in the admin area
 if( !defined('YOURLS_DEBUG') )
 	define( 'YOURLS_DEBUG', false ); // if set to true, verbose debug infos. Will break things. Don't enable.
 
 
+// If request for an admin page is http:// and SSL is required, redirect
+if( yourls_is_admin() && yourls_needs_ssl() && !yourls_is_ssl() ) {
+	if ( 0 === strpos($_SERVER['REQUEST_URI'], 'http') ) {
+		yourls_redirect( preg_replace('|^http://|', 'https://', $_SERVER['REQUEST_URI']) );
+		exit();
+	} else {
+		yourls_redirect( 'https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
+		exit();
+	}
+}
+
 // Create the YOURLS object $ydb that will contain everything we globally need
 if ( function_exists( 'yourls_db_connect' ) ) {
 	global $ydb;
diff --git a/yourls-infos.php b/yourls-infos.php
index 4ab36d4..0f4cd5a 100644
--- a/yourls-infos.php
+++ b/yourls-infos.php
@@ -161,7 +161,7 @@
 ?>
 
 <h1>
-	<a href="<?php echo YOURLS_SITE; ?>/admin/index.php" title="YOURLS"><span>YOURLS</span>: <span>Y</span>our <span>O</span>wn <span>URL</span> <span>S</span>hortener<br/>
+	<a href="<?php echo yourls_admin_url( 'index.php' ); ?>" title="YOURLS"><span>YOURLS</span>: <span>Y</span>our <span>O</span>wn <span>URL</span> <span>S</span>hortener<br/>
 	<img src="<?php echo YOURLS_SITE; ?>/images/yourls-logo.png" alt="YOURLS" title="YOURLS" style="border: 0px;" /></a>
 </h1>
 <?php if ( yourls_is_private() ) { ?>
-- 
2.45.0