-
Notifications
You must be signed in to change notification settings - Fork 179
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[InstallDB] Modifying the check to see whether http or https protocol is being used. #3658
Conversation
php/installer/Installer.class.inc
Outdated
@@ -273,7 +273,8 @@ class Installer | |||
// This is apparently the most reliable way to figure out if | |||
// the requery is over http or https.. $_SERVER[REQUEST_SCHEME] | |||
// is not reliable. | |||
$RequestScheme = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' | |||
$RequestScheme = isset($_SERVER['HTTP_X_FORWARDED_PROTO']) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Perhaps it would be better to check for both? Check first for $_SERVER['HTTPS']
and go to $_SERVER['HTTP_X_FORWARDED_PROTO']
if it fails
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It should definitely check for both. HTTP_X_FORWARDED_PROTO is only set if there's a proxy in between the server and PHP (and that proxy is setting the field).. it's not a reliable way to detect the protocol for servers that are directly served by a web server.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okay cool, will add that back again. If I were to also add an additional check for server_port (443), is that too much?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't know if PHP provides a way to get the server port, but even if it did it wouldn't be reliable since the server could be configured to run on any port for either http or https.
I think
$RequestScheme = 'http';
if (old way of checking || x-forwarded-proto) {
$RequestSchema = 'https';
}
should handle most configurations.
Script failed on my side, error log sent on slack I think it failed for a completely unrelated reason. Someone else should test this. |
It looks good to me, but any word on @ZainVirani's problem? Has it been (better?) tested? |
This pull request attempts to determine whether the http or https protocol is being used. It modifies the
getBaseURL()
function to check if$_SERVER['HTTP_X_FORWARDED_PROTO']
is set tohttps
rather than$_SERVER['HTTPS']
.