Merge pull request refinery#1540 from resolve/issue_1452

Fixes refinery#1452 by adding Refinery::Core.force_ssl (default false)
ChasManRors · Mar 31, 2012 · 55245f6 · 55245f6
2 parents 5b6d019 + c4339c0
commit 55245f6
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 3 deletions.
diff --git a/core/lib/generators/refinery/core/templates/config/initializers/refinery/core.rb.erb b/core/lib/generators/refinery/core/templates/config/initializers/refinery/core.rb.erb
@@ -2,6 +2,9 @@ Refinery::Core.configure do |config|
   # When true will rescue all not found errors and display a friendly error page
   config.rescue_not_found = Rails.env.production?
 
+  # When true this will force SSL redirection in all Refinery backend controllers.
+  # config.force_ssl = <%= Refinery::Core.force_ssl.inspect %>
+
   # When true will use Amazon's Simple Storage Service instead of
   # the default file system for storing resources and images
   config.s3_backend = !(ENV['S3_KEY'].nil? || ENV['S3_SECRET'].nil?)

diff --git a/core/lib/refinery/application_controller.rb b/core/lib/refinery/application_controller.rb
@@ -15,8 +15,9 @@ module ApplicationController
 
       send :include, Refinery::Crud # basic create, read, update and delete methods
 
-      send :before_filter, :refinery_user_required?,
-                           :if => :admin?
+      send :before_filter, :refinery_user_required?, :if => :admin?
+
+      send :before_filter, :force_ssl?, :if => :admin?
 
       send :after_filter, :store_current_location!,
                           :if => Proc.new {|c| send(:refinery_user?) }
@@ -64,6 +65,10 @@ def login?
 
   protected
 
+    def force_ssl?
+      redirect_to :protocol => 'https' unless request.ssl? && Refinery::Core.force_ssl
+    end
+
     # use a different model for the meta information.
     def present(model)
       presenter = if model && model.class.present? && defined?("#{model.class}Presenter")

diff --git a/core/lib/refinery/core/configuration.rb b/core/lib/refinery/core/configuration.rb
@@ -7,7 +7,7 @@ module Core
                     :menu_hide_children, :menu_css, :dragonfly_secret, :ie6_upgrade_message_enabled,
                     :show_internet_explorer_upgrade_message, :wymeditor_whitelist_tags,
                     :javascripts, :stylesheets, :s3_bucket_name, :s3_region, :s3_access_key_id,
-                    :s3_secret_access_key
+                    :s3_secret_access_key, :force_ssl
 
     self.rescue_not_found = false
     self.s3_backend = false
@@ -27,6 +27,7 @@ module Core
     self.s3_region = ENV['S3_REGION']
     self.s3_access_key_id = ENV['S3_KEY']
     self.s3_secret_access_key = ENV['S3_SECRET']
+    self.force_ssl = false
 
     def config.register_javascript(name)
       self.javascripts << name