Re: svn: /web/php-master/trunk/include/ functions.inc

On Wed, Mar 23, 2011 at 14:52, Ferenc Kovacs <info@tyrael.hu> wrote: > On Wed, Mar 23, 2011 at 2:26 PM, Richard Quadling <rquadling@gmail.com>wrote: > >> On 23 March 2011 13:14, Hannes Magnusson <bjori@php.net> wrote: >> > bjori                                    Wed, 23 Mar 2011 13:14:34 >> > +0000 >> > >> > Revision: >> > http://svn.php.net/viewvc?view=revision&revision=309599 >> > >> > Log: >> > Prettify, and advocate https until we kill http >> > >> > Changed paths: >> >    U   web/php-master/trunk/include/functions.inc >> > >> > Modified: web/php-master/trunk/include/functions.inc >> > =================================================================== >> > --- web/php-master/trunk/include/functions.inc  2011-03-23 13:14:12 UTC >> (rev 309598) >> > +++ web/php-master/trunk/include/functions.inc  2011-03-23 13:14:34 UTC >> (rev 309599) >> > @@ -34,9 +34,15 @@ >> >     <li><a >> > href="http://wiki.php.net/">Wiki</a></li> >> >     <li><a >> > href="http://bugs.php.net/">Bugsweb</a></li> >> >   </ul> >> > -  <h2>Have you changed your password yet?</h2> >> >  <?php >> > +if (!isset($_SERVER["HTTPS"]) || $_SERVER["HTTPS"] != >> > "on") { >> > +  warn("Why are you not using https?"); >> > +} else { >> > +  warn("Have you changed your password yet?"); >> >  } >> > +?> >> > +<?php >> > +} >> > >> >  function foot() { >> >   echo "</body></html>"; >> > >> > >> > -- >> > PHP Webmaster List Mailing List (http://www.php.net/) >> > To unsubscribe, visit: http://www.php.net/unsub.php >> > >> >> Using Google Chrome and IE on windows complains about the SSL cert. >> >> IE's recommendation is "We recommend that you close this webpage and >> do not continue to this website." >> >> Which is nicely severe. >> >> Examining the cert ... >> >> "This certificate cannot be verified up to a trusted certification >> authority." >> >> I don't normally bother with the error. It is only with regard to the >> recent breach that I'm raising this point. >> >> If https is being enforced, then not having a valid cert would >> certainly seem to be an issue. >> >> -- >> Richard Quadling >> Twitter : EE : Zend >> @RQuadling : e-e.com/M_248814.html : bit.ly/9O8vFY >> >> -- >> PHP Webmaster List Mailing List (http://www.php.net/) >> To unsubscribe, visit: http://www.php.net/unsub.php >> >> > if the money is the problem for getting decent(from a CA supported by the > major browsers, etc) ssl certs, then you should check out the free plan from > startssl, or ask for donations. > self-signed ssl sucks from the security point of view (you can't be sure > that you are seeing the warning because somebody man-in-the-middle you, or > the cert changed on the host, or that you visiting the site for the first > time, and didn't added to the trusted certs yet). > Its not self-signed. Its a cert from CACert.org. -Hannes