610457 - Admin link not displayed on HTTP pages

Status: VERIFIED FIXED

(Socorro :: General, task)

Description

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

With 1.7.5 we implemented a number of security fixes.  One of these causes the user to believe they are not logged in, when in fact they are.  When logged in, on http pages the link at the bottom only says "Login", while on https pages the link at the bottom says "Admin".

Comment 1

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

This change should also fix issues on other HTTP pages on the site, such as documented here:
https://bugzilla.mozilla.org/show_bug.cgi?id=575086#c9

Comment 4

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Attachment: Patch 1 for 610457

The following patch will force an authenticated user to view every page on the site in https.

Comment 5

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Committed what I thought would fix this issue, but it did not.  The problem is that Socorro UI only recognizes the secure cookie that determines whether the user is authenticated when on an https page, not on an http page.  That being the case, the fix for this problem is to force every page, regardless of authentication status, to https.

Is this something we want to do?

==

Sending        webapp-php/application/libraries/MY_Controller.php
Transmitting file data .
Committed revision 2777.

Comment 6

[Laura Thomson :laura]

We can force https.  The chief reason not to do this would be increased load on the LB, but Socorro webapp traffic is low enough that it's irrelevant.

We should make "force https" a setting though, because it will be easier for devs/testers not to have to set this up in their sandboxes.

Comment 7

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Attachment: Patch 2 for 610457

Let's try this again.  Instead of forcing all authenticated users to https, this patch forces all users to https across the site.

Comment 8

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Created Bug 614004 to update config file on stage.  We can test after this has been implemented. 

Updated docs at http://code.google.com/p/socorro/wiki/SocorroUpgrade

Committed:

==

Sending        webapp-php/application/config/auth.php-dist
Sending        webapp-php/application/libraries/MY_Controller.php
Transmitting file data ..
Committed revision 2779.

Comment 9

[Ryan Snyder [:ryansnyder] [:rsnyder] [:rysny]]

Working as expected on stage.

Comment 10

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED on staging: http://crash-stats.stage.mozilla.com/admin redirects me to https://crash-stats.stage.mozilla.com/admin, so I obviously no longer see the problem from comment 0.