ForceHTTPS setting implemented

Builder/Builder.exe.config

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?> 
 <configuration>
 	<appSettings>
-		<add key="WiXPath" value="C:\Program Files (x86)\Windows Installer XML v3\bin\"/>
+		<add key="WiXPath" value="C:\Program Files (x86)\Windows Installer XML v3.5\bin\"/>
 		<add key="SVNPath" value="C:\Program Files\SlikSvn\bin\"/>
 	</appSettings>
 </configuration>

Builder/IISMainHandler/build.txt

@@ -1 +1 @@
-1899
+1903

Common/Config.cs

@@ -39,6 +39,8 @@ namespace FLocal.Common {
 
 		public readonly string CookiesPrefix;
 		
+		public readonly bool forceHttps;
+
 		public readonly int MinPostId;
 
 		public readonly int SessionLifetime;
@@ -59,6 +61,7 @@ namespace FLocal.Common {
 			this.BaseHost = data["BaseHost"];
 			this.AdditionalHosts = new HashSet<string>(from host in data["AdditionalHosts"].Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries) select host.Trim());
 			this.CookiesPrefix = data["CookiesPrefix"];
+			this.forceHttps = parseBool(data["ForceHTTPS"]);
 			this.MinPostId = int.Parse(data["MinPostId"]);
 			this.SessionLifetime = int.Parse(data["SessionLifetime"]);
 		}

IISMainHandler/MainHandler.cs

@@ -15,11 +15,6 @@ namespace FLocal.IISHandler {
 
 		private void doProcessRequest(HttpContext httpcontext) {
 
-			Uri referer = httpcontext.Request.UrlReferrer;
-			if(referer != null && referer.PathAndQuery.StartsWith("/static") && !httpcontext.Request.Path.StartsWith("/static")) {
-				throw new HttpException(403, "You have come from the static page '" + referer + "'");
-			}
-
 			if(!Config.isInitialized) {
 				lock(typeof(Config)) {
 					if(!Config.isInitialized) {
@@ -32,6 +27,14 @@ namespace FLocal.IISHandler {
 			if(!current.Host.EndsWith(Config.instance.BaseHost)) {
 				throw new FLocal.Core.FLocalException("Wrong host: " + current.Host + " (expected *" + Config.instance.BaseHost + ")");
 			}
+			if(Config.instance.forceHttps && !httpcontext.Request.IsSecureConnection) {
+				throw new FLocal.Core.FLocalException("Only HTTPS connections are allowed");
+			}
+
+			Uri referer = httpcontext.Request.UrlReferrer;
+			if(referer != null && referer.PathAndQuery.StartsWith("/static") && !httpcontext.Request.Path.StartsWith("/static")) {
+				throw new HttpException(403, "You have come from the static page '" + referer + "'");
+			}
 
 			WebContext context = new WebContext(httpcontext);
 			try {

IISMainHandler/WebContext.cs

@@ -179,7 +179,7 @@ namespace FLocal.IISHandler {
 
 		private void AddCommonData(HttpCookie cookie) {
 			cookie.HttpOnly = true;
-			cookie.Secure = true;
+			cookie.Secure = Config.instance.forceHttps;
 			cookie.Domain = "." + String.Join(".", this.httprequest.Url.Host.Split(".", StringSplitOptions.RemoveEmptyEntries).Slice(1).ToArray());
 			cookie.Path = "/";
 		}