To be listed as a public site, you need to be an https site with a valid cert. If you don't make the cut, you will either not be listed as a public site or you will be de-listed. Period. This is non-negotiable.

1 files changed, 11 insertions, 0 deletions

diff --git a/include/zot.php b/include/zot.php
index 7c2cfe019..b7a22a099 100644
--- a/include/zot.php
+++ b/include/zot.php
@@ -1873,6 +1873,17 @@ function import_site($arr,$pubkey) {
 			$access_policy = ACCESS_TIERED;
 	}
 
+	// don't let insecure sites register as public hubs
+
+	if(strpos($arr['url'],'https://') === false)
+		$access_policy = ACCESS_PRIVATE;
+
+	if($access_policy != ACCESS_PRIVATE) {
+		$x = z_fetch_url($arr['url'] . '/siteinfo/json');
+		if(! $x['success'])
+			$access_policy = ACCESS_PRIVATE;
+	}
+	
 	$directory_url = htmlspecialchars($arr['directory_url'],ENT_COMPAT,'UTF-8',false);
 	$url = htmlspecialchars($arr['url'],ENT_COMPAT,'UTF-8',false);
 	$sellpage = htmlspecialchars($arr['sellpage'],ENT_COMPAT,'UTF-8',false);