From ee495843f0f142c1282ea4700d315ddaaf02ddfa Mon Sep 17 00:00:00 2001
From: "mkanat%bugzilla.org"
 <mkanat%bugzilla.org@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 29 Sep 2010 19:03:27 +0000
Subject: [PATCH] Bug 600475 - Support the 'includeSubDomains' flag as an
 option for the 'Strict-Transport-Security' advanced option in order to
 protect subdomains. [r=glob a=mkanat]

git-svn-id: svn://10.0.0.236/trunk@261301 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/webtools/bugzilla/.bzrrev                |  2 +-
 mozilla/webtools/bugzilla/Bugzilla/CGI.pm        |  8 ++++++--
 .../bugzilla/Bugzilla/Config/Advanced.pm         |  6 ++++--
 .../en/default/admin/params/advanced.html.tmpl   | 16 ++++++++++++++++
 4 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev
index 1030a8fb2fd..d141a18e487 100644
--- a/mozilla/webtools/bugzilla/.bzrrev
+++ b/mozilla/webtools/bugzilla/.bzrrev
@@ -1 +1 @@
-7494
\ No newline at end of file
+7495
\ No newline at end of file
diff --git a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
index de92cda9992..054ba96a0da 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/CGI.pm
@@ -276,8 +276,12 @@ sub header {
 
     # Add Strict-Transport-Security (STS) header if this response
     # is over SSL and the strict_transport_security param is turned on.
-    if ($self->https && Bugzilla->params->{'strict_transport_security'}) {
-        unshift(@_, '-strict-transport-security' => 'max-age=' . MAX_STS_AGE);
+    if ($self->https && Bugzilla->params->{'strict_transport_security'} ne 'off') {
+        my $sts_opts = 'max-age=' . MAX_STS_AGE;
+        if (Bugzilla->params->{'strict_transport_security'} eq 'include_subdomains') {
+            $sts_opts .= '; includeSubDomains';
+        }
+        unshift(@_, '-strict_transport_security' => $sts_opts);
     }
 
     return $self->SUPER::header(@_) || "";
diff --git a/mozilla/webtools/bugzilla/Bugzilla/Config/Advanced.pm b/mozilla/webtools/bugzilla/Bugzilla/Config/Advanced.pm
index e15a429630c..fada813f15b 100644
--- a/mozilla/webtools/bugzilla/Bugzilla/Config/Advanced.pm
+++ b/mozilla/webtools/bugzilla/Bugzilla/Config/Advanced.pm
@@ -55,8 +55,10 @@ use constant get_param_list => (
 
   {
    name => 'strict_transport_security',
-   type => 'b',
-   default => 0,
+   type => 's',
+   choices => ['off', 'this_domain_only', 'include_subdomains'],
+   default => 'off',
+   checker => \&check_multi
   },
 );
 
diff --git a/mozilla/webtools/bugzilla/template/en/default/admin/params/advanced.html.tmpl b/mozilla/webtools/bugzilla/template/en/default/admin/params/advanced.html.tmpl
index 10a1fb678d0..a8e8a297bb6 100644
--- a/mozilla/webtools/bugzilla/template/en/default/admin/params/advanced.html.tmpl
+++ b/mozilla/webtools/bugzilla/template/en/default/admin/params/advanced.html.tmpl
@@ -35,6 +35,22 @@
   on its domain (i.e., your <code>urlbase</code> is something like
   <code>http://bugzilla.example.com/</code>), and you never plan to disable
   the <code>ssl_redirect</code> parameter.
+  <ul>
+    <li>
+      off - Don't send the Strict-Transport-Security header with requests.
+    </li>
+    <li>
+      this_domain_only - Send the Strict-Transport-Security header with all
+      requests, but only support it for the current domain.
+    </li>
+    <li>
+      include_subdomains - Send the Strict-Transport-Security header along
+      with the <code>includeSubDomains</code> flag, which will apply the
+      security change to all subdomains. This is especially useful when
+      combined with an <code>attachment_base</code> that exists as (a)
+      subdomain(s) under the main [% terms.Bugzilla %] domain.
+    </li>
+  </ul>
 [% END %]
 
 [% param_descs = {