Re: pearweb https

Hi Folks:

> I just noticed that the bug emails and the pearweb login link both
> direct users to the http site.

Turns out the form submits using https, so it's not as bad as it looked.
But once logged in, it jumped back to http.  Considering the user name
and password (though hashed) are passed in the cookies, staying in https
is a good idea.

I made adjustments to the code so links to important forms use https
and stay in https afterward.  While at it, I added tokens to fend off
CSRF (cross-site request forgery) attacks.  All of that was done for
interfaces that require authentication (bugs, profile, admin, and package
management).

This stuff has been extensively tested and committed and is now on
test.pear.php.net.  But the https changes won't show up on the test site
due to it not being the live pear.php.net site.

[I'm not subscribed to the pearweb list.]

Thanks,

--Dan

-- 
 T H E   A N A L Y S I S   A N D   S O L U T I O N S   C O M P A N Y
            data intensive web and database programming
                http://www.AnalysisAndSolutions.com/
        4015 7th Ave #4, Brooklyn NY 11232  v: 718-854-0335