Fix HTTPS detection under Windows IIS (#2318118)

[squirrelmail.git] / functions / global.php

diff --git a/functions/global.php b/functions/global.php
index 7a77c256e080e93fa430e413752e2199cbb002f6..acfa06253b8cc3689741b14e6c698591de0f151a 100644 (file)
--- a/functions/global.php
+++ b/functions/global.php
@@ -517,9 +517,9 @@ function sqsetcookie($sName, $sValue='deleted', $iExpire=0, $sPath="", $sDomain=
                      $bSecure=false, $bHttpOnly=true, $bReplace=false) {
  
     // if we have a secure connection then limit the cookies to https only.
                      $bSecure=false, $bHttpOnly=true, $bReplace=false) {
  
     // if we have a secure connection then limit the cookies to https only.

-    if ($sName && isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']) {
+    global $is_secure_connection;
+    if ($sName && $is_secure_connection)

         $bSecure = true;
         $bSecure = true;

-    }

 
     // admin config can override the restriction of secure-only cookies
     global $only_secure_cookies;
 
     // admin config can override the restriction of secure-only cookies
     global $only_secure_cookies;


@@ -721,3 +721,51 @@ function sq_htmlspecialchars($value, $quote_style=ENT_QUOTES) {
 }
 
 
 }
 
 

+/**
+ * Detect whether or not we have a SSL secured (HTTPS) connection
+ * connection to the browser
+ *
+ * It is thought to be so if you have 'SSLOptions +StdEnvVars'
+ * in your Apache configuration,
+ *     OR if you have HTTPS set to a non-empty value (except "off")
+ *        in your HTTP_SERVER_VARS,
+ *     OR if you have HTTP_X_FORWARDED_PROTO=https in your HTTP_SERVER_VARS,
+ *     OR if you are on port 443.
+ *
+ * Note: HTTP_X_FORWARDED_PROTO could be sent from the client and
+ *       therefore possibly spoofed/hackable.  Thus, SquirrelMail
+ *       ignores such headers by default.  The administrator
+ *       can tell SM to use such header values by setting
+ *       $sq_ignore_http_x_forwarded_headers to boolean FALSE
+ *       in config/config.php or by using config/conf.pl.
+ *
+ * Note: It is possible to run SSL on a port other than 443, and
+ *       if that is the case, the administrator should set
+ *       $sq_https_port in config/config.php or by using config/conf.pl.
+ *
+ * @return boolean TRUE if the current connection is SSL-encrypted;
+ *                 FALSE otherwise.
+ *
+ * @since 1.4.17 and 1.5.2
+ *
+ */
+function is_ssl_secured_connection()
+{
+    global $sq_ignore_http_x_forwarded_headers, $sq_https_port;
+    $https_env_var = getenv('HTTPS');
+    if ($sq_ignore_http_x_forwarded_headers
+     || !sqgetGlobalVar('HTTP_X_FORWARDED_PROTO', $forwarded_proto, SQ_SERVER))
+        $forwarded_proto = '';
+    if (empty($sq_https_port)) // won't work with port 0 (zero)
+       $sq_https_port = 443;
+    if ((isset($https_env_var) && strcasecmp($https_env_var, 'on') === 0)
+     || (sqgetGlobalVar('HTTPS', $https, SQ_SERVER) && !empty($https)
+      && strcasecmp($https, 'off') !== 0)
+     || (strcasecmp($forwarded_proto, 'https') === 0)
+     || (sqgetGlobalVar('SERVER_PORT', $server_port, SQ_SERVER)
+      && $server_port == $sq_https_port))
+        return TRUE;
+    return FALSE;
+}
+
+