Take X-Forwarded-Host HTTP header in consideration when constructing

base_uri for redirects; reduces problems with transparent proxies
(#1488590). Also test strcasecmp on literally '0' with respect to
#1047883 although I don't think it's absolutely necessary, it's safest.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@11147 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/ChangeLog b/ChangeLog
index bc4780e35883d70d8b0fb29c67f444ad8bbeed5a..f64500bc1ed2614611a1d1c06b81d6c36bcd5831 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -56,6 +56,9 @@ Version 1.5.2 - CVS
   - Added PHP 5.1.0 date_default_timezone_set() function support. Allows
     to use time zone settings in PHP safe_mode.
   - Sanitized IMAP folder names in error_message() function and filters plugin.
+  - Take X-Forwarded-Host HTTP header in consideration when constructing
+    base_uri for redirects; reduces problems with transparent proxies
+    (#1488590).
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

diff --git a/functions/strings.php b/functions/strings.php
index 5f99b3858ae5c01653d317c51e4d3ffe0c8de2ad..b95ff5923e2671f73b407213cbfd1c768d291f79 100644 (file)
--- a/functions/strings.php
+++ b/functions/strings.php
@@ -493,17 +493,19 @@ function get_location () {
      *     OR if you are on port 443
      */
     $getEnvVar = getenv('HTTPS');
-    if ((isset($getEnvVar) && !strcasecmp($getEnvVar, 'on')) ||
-        (sqgetGlobalVar('HTTPS', $https_on, SQ_SERVER) && !strcasecmp($https_on, 'on')) ||
+    if ((isset($getEnvVar) && strcasecmp($getEnvVar, 'on') === 0) ||
+        (sqgetGlobalVar('HTTPS', $https_on, SQ_SERVER) && strcasecmp($https_on, 'on') === 0) ||
         (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER) &&  $server_port == 443)) {
         $proto = 'https://';
     }
 
     /* Get the hostname from the Host header or server config. */
-    if ( !sqgetGlobalVar('HTTP_HOST', $host, SQ_SERVER) || empty($host) ) {
-      if ( !sqgetGlobalVar('SERVER_NAME', $host, SQ_SERVER) || empty($host) ) {
-        $host = '';
-      }
+    if ( !sqgetGlobalVar('HTTP_X_FORWARDED_HOST', $host, SQ_SERVER) || empty($host) ) {
+        if ( !sqgetGlobalVar('HTTP_HOST', $host, SQ_SERVER) || empty($host) ) {
+            if ( !sqgetGlobalVar('SERVER_NAME', $host, SQ_SERVER) || empty($host) ) {
+                $host = '';
+            }
+        }
     }
 
     $port = '';