summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorcatch2012-11-20 11:07:38 (GMT)
committercatch2012-11-20 11:07:38 (GMT)
commit7525d1a702e0282a90443519e8c9f8be3573b39b (patch)
tree760ec4a421e64b47ca2741e50f95ea76331371e8
parente62125d6ef685eae3a83249ca51cd1a38486e418 (diff)
Issue #1733476 by greggles, BMDan: Fixed Make default htaccess rules protocol sensitive to avoid man-in-the-middle-attacks if users don't fully customize the rule.
-rw-r--r--.htaccess12
1 files changed, 10 insertions, 2 deletions
diff --git a/.htaccess b/.htaccess
index 895bd4c..4648105 100644
--- a/.htaccess
+++ b/.htaccess
@@ -56,6 +56,13 @@ DirectoryIndex index.php index.html index.htm
<IfModule mod_rewrite.c>
RewriteEngine on
+ # Set "protossl" to "s" if we were accessed via https://. This is used later
+ # if you enable "www." stripping or enforcement, in order to ensure that
+ # you don't bounce between http and https.
+ RewriteRule ^ - [E=protossl]
+ RewriteCond %{HTTPS} on
+ RewriteRule ^ - [E=protossl:s]
+
# Block access to "hidden" directories whose names begin with a period. This
# includes directories used by version control systems such as Subversion or
# Git to store control files. Files whose names begin with a period, as well
@@ -78,14 +85,15 @@ DirectoryIndex index.php index.html index.htm
# To redirect all users to access the site WITH the 'www.' prefix,
# (http://example.com/... will be redirected to http://www.example.com/...)
# uncomment the following:
+ # RewriteCond %{HTTP_HOST} .
# RewriteCond %{HTTP_HOST} !^www\. [NC]
- # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+ # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
#
# To redirect all users to access the site WITHOUT the 'www.' prefix,
# (http://www.example.com/... will be redirected to http://example.com/...)
# uncomment the following:
# RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
- # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301]
+ # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]
# Modify the RewriteBase if you are using Drupal in a subdirectory or in a
# VirtualDocumentRoot and the rewrite rules are not working properly.