From 7ddada5c0c7518e941d57de07313a19b00eb6ee1 Mon Sep 17 00:00:00 2001
From: Stephen Liang <github@stephenliang.pw>
Date: Sun, 5 Oct 2014 18:19:14 -0500
Subject: [PATCH] If a user logs in while not on https, then the user should be
 sent back to the non-secure website.

Bug: 71716
Change-Id: I7c24b779e5f4b01bd400a1833e12932f7b01f848
---
 includes/specials/SpecialUserlogin.php | 8 +++++++-
 includes/templates/Userlogin.php       | 1 +
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/includes/specials/SpecialUserlogin.php b/includes/specials/SpecialUserlogin.php
index bdd6751ea8..3441f7a6c0 100644
--- a/includes/specials/SpecialUserlogin.php
+++ b/includes/specials/SpecialUserlogin.php
@@ -145,7 +145,8 @@ class LoginForm extends SpecialPage {
 		$this->mLoginattempt = $request->getCheck( 'wpLoginattempt' );
 		$this->mAction = $request->getVal( 'action' );
 		$this->mRemember = $request->getCheck( 'wpRemember' );
-		$this->mFromHTTP = $request->getBool( 'fromhttp', false );
+		$this->mFromHTTP = $request->getBool( 'fromhttp', false )
+			|| $request->getBool( 'wpFromhttp', false );
 		$this->mStickHTTPS = ( !$this->mFromHTTP && $request->getProtocol() === 'https' )
 			|| $request->getBool( 'wpForceHttps', false );
 		$this->mLanguage = $request->getText( 'uselang' );
@@ -1435,6 +1436,11 @@ class LoginForm extends SpecialPage {
 			$template->set( 'signupend', $this->msg( 'signupend' )->parse() );
 		}
 
+		// If using HTTPS coming from HTTP, then the 'fromhttp' parameter must be preserved
+		if ( $usingHTTPS ) {
+			$template->set( 'fromhttp', $this->mFromHTTP );
+		}
+
 		// Give authentication and captcha plugins a chance to modify the form
 		$wgAuth->modifyUITemplate( $template, $this->mType );
 		if ( $this->mType == 'signup' ) {
diff --git a/includes/templates/Userlogin.php b/includes/templates/Userlogin.php
index 99fe2185d2..fd16552627 100644
--- a/includes/templates/Userlogin.php
+++ b/includes/templates/Userlogin.php
@@ -187,6 +187,7 @@ class UserloginTemplate extends BaseTemplate {
 			<?php if ( $this->haveData( 'uselang' ) ) { ?><input type="hidden" name="uselang" value="<?php $this->text( 'uselang' ); ?>" /><?php } ?>
 			<?php if ( $this->haveData( 'token' ) ) { ?><input type="hidden" name="wpLoginToken" value="<?php $this->text( 'token' ); ?>" /><?php } ?>
 			<?php if ( $this->data['cansecurelogin'] ) {?><input type="hidden" name="wpForceHttps" value="<?php $this->text( 'stickhttps' ); ?>" /><?php } ?>
+			<?php if ( $this->data['cansecurelogin'] && $this->haveData( 'fromhttp' )) {?><input type="hidden" name="wpFromhttp" value="<?php $this->text( 'fromhttp' ); ?>" /><?php } ?>
 		</form>
 	</div>
 </div>
-- 
2.20.1