Skip to content
Permalink
Browse files

* all apps: fixing serveral cases of wrong Url when proxying and term…

…inating TLS on the proxy
  • Loading branch information
ralfbecker committed Nov 15, 2019
1 parent 71baa86 commit 7cd4169768ec27d8c59e4c079c3dba64d82c8062
@@ -278,8 +278,7 @@ function __construct()
}
else
{
$this->current_user_principal = (@$_SERVER["HTTPS"] === "on" ? "https:" : "http:") .
'//' . $_SERVER['HTTP_HOST'] . $_SERVER['SCRIPT_NAME'] . '/';
$this->current_user_principal = Framework::getUrl($_SERVER['SCRIPT_NAME']) . '/';
}
$this->current_user_principal .= 'principals/users/'.$GLOBALS['egw_info']['user']['account_lid'].'/';

@@ -1519,16 +1518,7 @@ protected static function fopen_attachment($app, $id, $_filename, $mime=null, &$
*/
protected static function path2location($path)
{
static $url_prefix = null;
if (!isset($url_prefix))
{
$url_prefix = '';
if ($GLOBALS['egw_info']['server']['webserver_url'][0] == '/')
{
$url_prefix = ($_SERVER['HTTPS'] ? 'https' : 'http').'://'.$_SERVER['HTTP_HOST'];
}
}
return $url_prefix.Framework::link(Vfs::download_url($path));
return Framework::getUrl(Framework::link(Vfs::download_url($path)));
}

/**
@@ -369,12 +369,7 @@ public function check_return_representation($options, $id, $user=null)
{
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
$location = $this->caldav->base_uri.$options['path'];
if ($location[0] == '/')
{
$location = (@$_SERVER['HTTPS'] === 'on' ? 'https' : 'http').'://'.$_SERVER['HTTP_HOST'].$location;
}
header('Content-Location: '.$location);
header('Content-Location: '.Api\Framework::getUrl($this->caldav->base_uri.$options['path']));
}

// remove If-Match or If-None-Match headers, otherwise HTTP status 412 goes into endless loop!
@@ -687,7 +682,7 @@ public function base_uri($full_uri=true)
$uri = $path = $this->caldav->base_uri;
if ($uri[0] == '/')
{
$uri = ($_SERVER["HTTPS"] === "on" ? "https:" : "http:") .'//' . $_SERVER['HTTP_HOST'] . $uri;
$uri = Api\Framework::getUrl($uri);
}
else
{
@@ -290,9 +290,9 @@ function load_optional_classes()
*/
function verify_session()
{
if($GLOBALS['egw_info']['server']['enforce_ssl'] === 'redirect' && !$_SERVER['HTTPS'])
if($GLOBALS['egw_info']['server']['enforce_ssl'] === 'redirect' && Header\Http::schema() !== 'https')
{
Header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
Header('Location: https://' . Header\Http::host() . $_SERVER['REQUEST_URI']);
exit;
}
// check if we have a session, if not try to automatic create one
@@ -6797,7 +6797,7 @@ static function processURL2InlineImages(Mailer $_mailObject, &$_html2parse, $mai
$myUrl = $directory.$filename;
if ($myUrl[0]=='/') // local path -> we only allow path's that are available via http/https (or vfs)
{
$basedir = ($_SERVER['HTTPS']?'https://':'http://'.$_SERVER['HTTP_HOST']);
$basedir = Api\Framework::getUrl('/');
}
// use vfs instead of url containing webdav.php
// ToDo: we should test if the webdav url is of our own scope, as we cannot handle foreign
@@ -1633,7 +1633,7 @@ public static function egw_setcookie($cookiename,$cookievalue='',$cookietime=0,$
!$cookietime && $is_iOS ? time()+self::IOS_SESSION_COOKIE_LIFETIME : $cookietime,
is_null($cookiepath) ? self::$cookie_path : $cookiepath,self::$cookie_domain,
// if called via HTTPS, only send cookie for https and only allow cookie access via HTTP (true)
empty($GLOBALS['egw_info']['server']['insecure_cookies']) && !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off', true);
empty($GLOBALS['egw_info']['server']['insecure_cookies']) && Header\Http::schema() === 'https', true);
}
}

@@ -1671,7 +1671,7 @@ private static function set_cookiedomain()

session_set_cookie_params(0, self::$cookie_path, self::$cookie_domain,
// if called via HTTPS, only send cookie for https and only allow cookie access via HTTP (true)
empty($GLOBALS['egw_info']['server']['insecure_cookies']) && !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off', true);
empty($GLOBALS['egw_info']['server']['insecure_cookies']) && Header\Http::schema() === 'https', true);
}

/**
@@ -734,15 +734,7 @@ static function download_url($_url,$force_download=false)

$relpath = substr($url,strlen($mount_url));

$download_url = Vfs::concat($get['url'],$relpath);
if ($download_url[0] == '/')
{
$download_url = ($_SERVER['HTTPS'] ? 'https://' : 'http://').
$_SERVER['HTTP_HOST'].$download_url;
}

//die(__METHOD__."('$url') --> relpath = $relpath --> $download_url");
return $download_url;
return Api\Framework::getUrl(Vfs::concat($get['url'],$relpath));
}

/**
@@ -75,7 +75,7 @@ function _egw_log_exception($e,&$headline=null)
error_log($line);
}
error_log('# Instance='.$GLOBALS['egw_info']['user']['domain'].', User='.$GLOBALS['egw_info']['user']['account_lid'].
', Request='.$_SERVER['REQUEST_METHOD'].' '.($_SERVER['HTTPS']?'https://':'http://').$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'].
', Request='.$_SERVER['REQUEST_METHOD'].' '.Api\Framework::getUrl($_SERVER['REQUEST_URI']).
', User-agent='.$_SERVER['HTTP_USER_AGENT']);
}
}
@@ -2116,9 +2116,8 @@ static function freebusy_url($user='',$pw=null)
. ':' . $GLOBALS['egw_info']['user']['passwd'];
$credentials = '&cred=' . base64_encode($credentials);
}
return (!$GLOBALS['egw_info']['server']['webserver_url'] || $GLOBALS['egw_info']['server']['webserver_url'][0] == '/' ?
($_SERVER['HTTPS'] ? 'https://' : 'http://').$_SERVER['HTTP_HOST'] : '').
$GLOBALS['egw_info']['server']['webserver_url'].'/calendar/freebusy.php/?user='.urlencode($user).$credentials;
return Api\Framework::getUrl($GLOBALS['egw_info']['server']['webserver_url']).
'/calendar/freebusy.php/?user='.urlencode($user).$credentials;
}

/**
@@ -20,15 +20,6 @@

use EGroupware\Api;

// switching off output compression for Lighttpd and HTTPS, as it makes problems with TB Lightning
if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on' &&
strpos($_SERVER['SERVER_SOFTWARE'],'lighttpd/1.4') === 0 &&
strpos($_SERVER['HTTP_USER_AGENT'],'Lightning') !== false)
{
ini_set('zlib.output_compression',0);
}
//error_log("HTTPS='$_SERVER[HTTPS]', SERVER_SOFTWARE='$_SERVER[SERVER_SOFTWARE]', HTTP_USER_AGENT='$_SERVER[HTTP_USER_AGENT]', REQUEST_METHOD='$_SERVER[REQUEST_METHOD]' --> zlib.output_compression=".ini_get('zlib.output_compression'));

$starttime = microtime(true);

$GLOBALS['egw_info'] = array(
@@ -42,11 +42,7 @@ function replace_callback($matches)
switch($matches[1])
{
case 'egw_dc_url':
$replacement = $GLOBALS['egw_info']['server']['webserver_url'];
if (empty($replacement) || $replacement[0] == '/')
{
$replacement = ($_SERVER['HTTPS'] ? 'https://' : 'http://').$_SERVER['HTTP_HOST'].$replacement;
}
$replacement = Api\Framework::getUrl($GLOBALS['egw_info']['server']['webserver_url']);
break;
case 'egw_dc_logindomain':
$replacement = $GLOBALS['egw_info']['user']['domain'];
@@ -188,7 +188,7 @@ function set_cookie($cookiename,$cookievalue='',$cookietime=0)
}
setcookie($cookiename, $cookievalue, $cookietime, '/', $this->cookie_domain,
// if called via HTTPS, only send cookie for https and only allow cookie access via HTTP (true)
!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off', true);
Api\Header\Http::schema() === 'https', true);
}

/**
@@ -257,7 +257,7 @@ private static function session_start()
session_name(self::SESSIONID);
session_set_cookie_params(0, '/', self::cookiedomain(),
// if called via HTTPS, only send cookie for https and only allow cookie access via HTTP (true)
!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off', true);
Api\Header\Http::schema() === 'https', true);

if (isset($_COOKIE[self::SESSIONID])) session_id($_COOKIE[self::SESSIONID]);

0 comments on commit 7cd4169

Please sign in to comment.
You can’t perform that action at this time.