From 5938925a35129ed35ff059ba7aadbc02b5d923cd Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Wed, 20 Sep 2023 14:51:29 -0400
Subject: [PATCH] Added an error if accessing ITFlow by HTTP:// and  is set to
 true

---
 login.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/login.php b/login.php
index 44a656fe..3575c244 100644
--- a/login.php
+++ b/login.php
@@ -1,5 +1,6 @@
 <?php
 
+// Enforce a Content Security Policy for security against cross-site scripting
 header("Content-Security-Policy: default-src 'self' fonts.googleapis.com fonts.gstatic.com");
 
 if (!file_exists('config.php')) {
@@ -8,6 +9,14 @@ if (!file_exists('config.php')) {
 }
 
 require_once("config.php");
+
+// Check if the application is configured for HTTPS-only access
+if ($config_https_only && (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on')) {
+    echo "Login is restricted as ITFlow defaults to HTTPS-only for enhanced security. To login using HTTP, modify the config.php file by setting config_https_only to false. However, this is strongly discouraged, especially when accessing from potentially unsafe networks like the internet.";
+    exit;
+}
+
+
 require_once("functions.php");
 require_once("rfc6238.php");