Fix not to completely forbid password reset without SSL

forgot.cgi

@@ -14,7 +14,8 @@ $trust_unknown_referers = 1;
 $gconfig{'forgot_pass'} || &error($text{'forgot_ecannot'});
 my $timeout = $gconfig{'passreset_timeout'} || 15;
 $remote_user && &error($text{'forgot_elogin'});
-$ENV{'HTTPS'} eq 'ON' || &error($text{'forgot_essl'});
+$ENV{'HTTPS'} eq 'ON' || $gconfig{'forgot_pass'} == 2 ||
+        &error($text{'forgot_essl'});
 
 # Check that the random ID is valid
 $in{'id'} =~ /^[a-f0-9]+$/i || &error($text{'forgot_eid'});

forgot_form.cgi

@@ -13,7 +13,8 @@ $trust_unknown_referers = 1;
 &error_setup($text{'forgot_err'});
 $gconfig{'forgot_pass'} || &error($text{'forgot_ecannot'});
 $remote_user && &error($text{'forgot_elogin'});
-$ENV{'HTTPS'} eq 'ON' || &error($text{'forgot_essl'});
+$ENV{'HTTPS'} eq 'ON' || $gconfig{'forgot_pass'} == 2 ||
+        &error($text{'forgot_essl'});
 
 &ui_print_header(undef, $text{'forgot_title'}, "", undef, undef, 1, 1);
 

forgot_send.cgi

@@ -12,7 +12,8 @@ $no_acl_check++;
 &error_setup($text{'forgot_err'});
 $gconfig{'forgot_pass'} || &error($text{'forgot_ecannot'});
 $remote_user && &error($text{'forgot_elogin'});
-$ENV{'HTTPS'} eq 'ON' || &error($text{'forgot_essl'});
+$ENV{'HTTPS'} eq 'ON' || $gconfig{'forgot_pass'} == 2 ||
+        &error($text{'forgot_essl'});
 
 # Lookup the Webmin user
 &foreign_require("acl");

lang/en

@@ -183,7 +183,8 @@ forgot_eunixlock=User user's password is locked!
 forgot_elogin=Forgotten password pages cannot be used when you are already logged in to Webmin!
 forgot_erate=Too many password reset attempts for $1! Please try again later.
 forgot_eremote=Webmin server on this system is not running or is not configured to allow forgotten password recovery.
-forgot_essl=Forgotten password recovery can only be used over an SSL connection
+forgot_essl=Forgotten password recovery can only be used over an SSL connection unless explicitly allowed
+forgot_nossl=Yes, and allow over insecure connection
 
 pam_header=Login to Webmin
 pam_mesg=You must respond to the question below to login to Webmin server on $1.

usermin/edit_session.cgi

@@ -39,7 +39,10 @@ print &ui_table_row("",
 
 # Enable forgotten password recovery
 print &ui_table_row($text{'session_forgot'},
-	&ui_yesno_radio("forgot", $uconfig{'forgot_pass'}));
+        &ui_radio("forgot", $uconfig{'forgot_pass'},
+			  [ [ 0, $text{'no'}."<br>" ],
+			    [ 1, $text{'yes'}."<br>" ],
+			    [ 2, $text{'forgot_nossl'} ] ]));
 
 # Log to syslog
 eval "use Sys::Syslog qw(:DEFAULT setlogsock)";

webmin/edit_session.cgi

@@ -42,7 +42,10 @@ print &ui_table_row("",
 
 # Enable forgotten password recovery
 print &ui_table_row($text{'session_forgot'},
-	&ui_yesno_radio("forgot", $gconfig{'forgot_pass'}));
+	&ui_radio("forgot", $gconfig{'forgot_pass'},
+			  [ [ 0, $text{'no'}."<br>" ],
+			    [ 1, $text{'yes'}."<br>" ],
+			    [ 2, $text{'forgot_nossl'} ] ]));
 
 # Block bad password requests
 $gconfig{'passreset_failures'} //= 3;