Re: svn: /web/php-master/trunk/include/ functions.inc

On Wed, Mar 23, 2011 at 2:26 PM, Richard Quadling <rquadling@gmail.com>wrote: > On 23 March 2011 13:14, Hannes Magnusson <bjori@php.net> wrote: > > bjori Wed, 23 Mar 2011 13:14:34 +0000 > > > > Revision: > > http://svn.php.net/viewvc?view=revision&revision=309599 > > > > Log: > > Prettify, and advocate https until we kill http > > > > Changed paths: > > U web/php-master/trunk/include/functions.inc > > > > Modified: web/php-master/trunk/include/functions.inc > > =================================================================== > > --- web/php-master/trunk/include/functions.inc 2011-03-23 13:14:12 UTC > (rev 309598) > > +++ web/php-master/trunk/include/functions.inc 2011-03-23 13:14:34 UTC > (rev 309599) > > @@ -34,9 +34,15 @@ > > <li><a href="̱tÂM0ÒH > > çy1Ð÷http://wiki.php.net/">Wiki</a></li> > > <li><a > > href="http://bugs.php.net/">Bugsweb</a></li> > > </ul> > > - <h2>Have you changed your password yet?</h2> > > <?php > > +if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != "on") > > { > > + warn("Why are you not using https?"); > > +} else { > > + warn("Have you changed your password yet?"); > > } > > +?> > > +<?php > > +} > > > > function foot() { > > echo "</body></html>"; > > > > > > -- > > PHP Webmaster List Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > Using Google Chrome and IE on windows complains about the SSL cert. > > IE's recommendation is "We recommend that you close this webpage and > do not continue to this website." > > Which is nicely severe. > > Examining the cert ... > > "This certificate cannot be verified up to a trusted certification > authority." > > I don't normally bother with the error. It is only with regard to the > recent breach that I'm raising this point. > > If https is being enforced, then not having a valid cert would > certainly seem to be an issue. > > -- > Richard Quadling > Twitter : EE : Zend > @RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY > > -- > PHP Webmaster List Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > if the money is the problem for getting decent(from a CA supported by the major browsers, etc) ssl certs, then you should check out the free plan from startssl, or ask for donations. self-signed ssl sucks from the security point of view (you can't be sure that you are seeing the warning because somebody man-in-the-middle you, or the cert changed on the host, or that you visiting the site for the first time, and didn't added to the trusted certs yet). Tyrael