@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Lock "security.require-https" from web edits
Summary: This can be used to lock yourself out of an instance, so prevent web edits.
Test Plan: Loaded page, wasn't web-editable.
Reviewers: btrahan
Reviewed By: btrahan
Subscribers: epriestley
Differential Revision: https://secure.phabricator.com/D8572
+5
-6
+5
-6
src/applications/config/option/PhabricatorSecurityConfigOptions.php
+5
-6
src/applications/config/option/PhabricatorSecurityConfigOptions.php
···
52
52
"want (to any other string), but doing so will break existing ".
53
53
"sessions and CSRF tokens.")),
54
54
$this->newOption('security.require-https', 'bool', false)
55
+
->setLocked(true)
55
56
->setSummary(
56
-
pht("Force users to connect via https instead of http."))
57
+
pht("Force users to connect via HTTPS instead of HTTP."))
57
58
->setDescription(
58
59
pht(
59
60
"If the web server responds to both HTTP and HTTPS requests but ".
···
67
68
"balancer which terminates HTTPS connections and you can not ".
68
69
"reasonably configure more granular behavior there.\n\n".
69
70
70
-
"NOTE: Phabricator determines if a request is HTTPS or not by ".
71
-
"examining the PHP \$_SERVER['HTTPS'] variable. If you run ".
71
+
"IMPORTANT: Phabricator determines if a request is HTTPS or not ".
72
+
"by examining the PHP \$_SERVER['HTTPS'] variable. If you run ".
72
73
"Apache/mod_php this will probably be set correctly for you ".
73
74
"automatically, but if you run Phabricator as CGI/FCGI (e.g., ".
74
75
"through nginx or lighttpd), you need to configure your web ".
75
76
"server so that it passes the value correctly based on the ".
76
-
"connection type. Alternatively, you can add a PHP snippet to ".
77
-
"the top of this configuration file to directly set ".
78
-
"\$_SERVER['HTTPS'] to the correct value."))
77
+
"connection type."))
79
78
->setBoolOptions(
80
79
array(
81
80
pht('Force HTTPS'),