Forcing SSL for logins

I'm brand new to Gallery (it is freaking awesome by the way) and am a security guy. I've got G2 set up on both SSL and non-SSL ports. However, the SSL version does not make use of an HTTPS URL for the login form. So, I want to do two things:

1) Make the Gallery SSL version utilize the HTTPS URL for the login form (and for any URLs I would imagine). The code for the main login form seems to be in modules/core/templates/LoginSystemContent.tpl and uses the Gallery internal smarty variable {g->url}. Is there a bug that may be causing this variable to be set with HTTP rather than HTTPS?

2) Make the Gallery non-SSL version utilize HTTPS URLs for any login forms so that guests can browse without SSL, but admins and album administrators can utilize HTTPS for their login session.

Any pointers would be appreciated!

-Jason

The UserLogin.inc controller could check if the protocol used to login is https or not. And if not, it could gracefully fail / redirect to a ssl page.

Certainly understand the need to secure the session data as well as login and password. The ideal solution would ensure SSL for any authenticated user.

As for the comment from bharat "theoretically you can enable security just by controlling your own URL", practice is not living up to the theory. Like I said in my initial post, the {g->url} value does not contain HTTPS even when the whole Apache virtualhost I'm using to access gallerys is SSL-enabled.

Perhaps there is an issue with the rewrite module that is rewriting the base URL to be HTTP only? I'll try disabling this module and see if anything changes.... Okay, I did just that and did indeed find that it is the URL Rewrite module that is forcing the relative URLs to be HTTP and not HTTPS. Somehow it is modifying {g->url} in a bad way that is not protocol-agnostic. Will need more investigation. I do have a dual HTTP/HTTPS instance so URL Rewrite must not be advanced enough to handle this.

Seems like if this were to be fixed, it would address one of the issues. Then the remaining item would be to modify the right files to force the login form targets at least to be HTTPS. Probably will need more research to see how to keep the whole authenticated user session on the HTTPS instance.

I am very much interested in implementing some of the things talked about in this post.

It seems the two files that need patching in order to redirect the non-ssl login page to an ssl one... modules/core/AdminCore.inc and modules/core/UserLogin.inc

bharat said that AdminCore.inc would need to have a core paramter added that would require the login page to be ssl...

then i guess the actual redirect to the ssl page would take place in UserLogin.inc

Do I have this right?

Anyway, I am not very experienced with php and would appreciate any help/direction that anyone could provide. I would really like to get it working this way before i make my gallery2 install internet facing.

thanks for any help

the question is how you access G2. and obviously you access your multisites with https, hence it's secure (it's using SSL).

In the config.php, I tried setting the baseUri to https://example.com:8080/gallery2/index.php and was getting a strange error where after authenticating, it would take me back to the login page. I found a different thread that talked about setting this to https://example.com:8080/gallery2/main.php and it now logs me in correctly. This seems to force SSL in that I now can't login with HTTP because it redirects to HTTPS.

Am I safe to assume that the baseUri redirect will always force the use of SSL?

You can force logged-in users to use HTTPS (and guest users to use HTTP) by looking for the login cookie using mod_rewrite in Apache.

In your HTTP VirtualHost, put:
RewriteEngine On
RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
RewriteCond %{QUERY_STRING} subView=core\.UserLogin
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]

In your HTTPS VirtualHost, put:
RewriteEngine On
RewriteCond %{HTTP_COOKIE} =""
RewriteCond %{REQUEST_METHOD} =GET
RewriteCond %{QUERY_STRING} !subView=core\.UserLogin
RewriteRule ^ http://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]

Then, unset baseUri in config.php (to keep Gallery from trying to redirect users to either HTTP or HTTPS):
$gallery->setConfig('baseUri', '');