Also check the X-Forwarded-Proto header when determining HTTPS (see #…

…8691).
contao · Apr 18, 2017 · 40a0541 · 40a0541
1 parent 73218ac
commit 40a0541
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/system/docs/CHANGELOG.md b/system/docs/CHANGELOG.md
@@ -4,6 +4,9 @@ Contao Open Source CMS changelog
 Version 3.5.26 (2017-XX-XX)
 ---------------------------
 
+### Fixed
+Also check the X-Forwarded-Proto header when determining HTTPS (see #8691).
+
 ### Fixed
 Correctly support 64 character template names everywhere (see #6819).
 

diff --git a/system/modules/core/library/Contao/Environment.php b/system/modules/core/library/Contao/Environment.php
@@ -311,6 +311,11 @@ protected static function httpXForwardedHost()
 	 */
 	protected static function ssl()
 	{
+		if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && in_array($_SERVER['REMOTE_ADDR'], trimsplit(',', \Config::get('proxyServerIps'))))
+		{
+		    return $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https';
+		}
+
 		return ($_SERVER['SSL_SESSION_ID'] || $_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1);
 	}