From 154dda4a691d83662e2f201da1584e160de10507 Mon Sep 17 00:00:00 2001 From: pdontthink Date: Thu, 4 Dec 2008 21:34:53 +0000 Subject: [PATCH] Fix port detection (2388423) git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@13348 7612ce4b-ef26-0410-bec9-ea0150e637f0 --- functions/strings.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/functions/strings.php b/functions/strings.php index 1fcbd6dc..b199b1f8 100644 --- a/functions/strings.php +++ b/functions/strings.php @@ -509,6 +509,17 @@ function get_location () { $port = ''; if (! strstr($host, ':')) { + // Note: HTTP_X_FORWARDED_PROTO could be sent from the client and + // therefore possibly spoofed/hackable - for now, the + // administrator can tell SM to ignore this value by setting + // $sq_ignore_http_x_forwarded_headers to boolean TRUE in + // config/config_local.php, but in the future we may + // want to default this to TRUE and make administrators + // who use proxy systems turn it off (see 1.5.2+). + global $sq_ignore_http_x_forwarded_headers; + if ($sq_ignore_http_x_forwarded_headers + || !sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER)) + $forwarded_proto = ''; if (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER)) { if (($server_port != 80 && $proto == 'http://') || ($server_port != 443 && $proto == 'https://' && -- 2.25.1