Adds system check for forced SSL connection (#13193)

* Adds system check for forced SSL connection

* review adjustments

* update screenshots

* update screenshot

2 files changed, 48 insertions, 0 deletions

diff --git a/plugins/Diagnostics/Diagnostic/ForceSSLCheck.php b/plugins/Diagnostics/Diagnostic/ForceSSLCheck.php
new file mode 100644
index 0000000000..de21240bf0
--- /dev/null
+++ b/plugins/Diagnostics/Diagnostic/ForceSSLCheck.php
@@ -0,0 +1,47 @@
+<?php
+/**
+ * Matomo - free/libre analytics platform
+ *
+ * @link http://piwik.org
+ * @license http://www.gnu.org/licenses/gpl-3.0.html GPL v3 or later
+ */
+namespace Piwik\Plugins\Diagnostics\Diagnostic;
+
+use Piwik\Config;
+use Piwik\ProxyHttp;
+use Piwik\Translation\Translator;
+
+/**
+ * Check that Matomo is configured to force SSL.
+ */
+class ForceSSLCheck implements Diagnostic
+{
+    /**
+     * @var Translator
+     */
+    private $translator;
+
+    public function __construct(Translator $translator)
+    {
+        $this->translator = $translator;
+    }
+
+    public function execute()
+    {
+        $label = $this->translator->translate('General_ForcedSSL');
+
+        $forceSSLEnabled = (Config::getInstance()->General['force_ssl'] == 1);
+
+        if ($forceSSLEnabled) {
+            return array(DiagnosticResult::singleResult($label, DiagnosticResult::STATUS_OK));
+        }
+
+        $comment = $this->translator->translate('General_ForceSSLRecommended', ['<code>force_ssl = 1</code>', '<code>General</code>']);
+
+        if (!ProxyHttp::isHttps()) {
+            $comment .= '<br /><br />' . $this->translator->translate('General_NotPossibleWithoutHttps');
+        }
+
+        return array(DiagnosticResult::singleResult($label, DiagnosticResult::STATUS_WARNING, $comment));
+    }
+}
diff --git a/plugins/Diagnostics/config/config.php b/plugins/Diagnostics/config/config.php
index 4e300166e7..13bf140925 100644
--- a/plugins/Diagnostics/config/config.php
+++ b/plugins/Diagnostics/config/config.php
@@ -25,6 +25,7 @@ return array(
         DI\get('Piwik\Plugins\Diagnostics\Diagnostic\CronArchivingCheck'),
         DI\get('Piwik\Plugins\Diagnostics\Diagnostic\LoadDataInfileCheck'),
         Di\get('Piwik\Plugins\Diagnostics\Diagnostic\DbOverSSLCheck'),
+        Di\get('Piwik\Plugins\Diagnostics\Diagnostic\ForceSSLCheck'),
     ),
     // Allows other plugins to disable diagnostics that were previously registered
     'diagnostics.disabled' => array(),