make sure we prefer forwarded proto header over regular header (#10081)

matomo-org · Jul 14, 2016 · e2baedc · e2baedc
1 parent 7b7df74
commit e2baedc
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 0 deletions.
diff --git a/core/Url.php b/core/Url.php
@@ -711,6 +711,10 @@ public static function isSecureConnectionAssumedByPiwikButNotForcedYet()
      */
     protected static function getCurrentSchemeFromRequestHeader()
     {
+        if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'http') {
+            return 'http';
+        }
+
         if ((isset($_SERVER['HTTPS']) && ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] === true))
             || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
         ) {

diff --git a/tests/PHPUnit/Unit/UrlTest.php b/tests/PHPUnit/Unit/UrlTest.php
@@ -72,6 +72,43 @@ public function testGetCurrentHost($description, $test)
         $this->assertEquals($test[4], Url::getCurrentHost(), $description);
     }
 
+    /**
+     * @dataProvider getProtocol
+     */
+    public function test_getCurrentScheme_ProtoHeaderShouldPrecedenceHttpsHeader($proto)
+    {
+        $_SERVER['HTTPS'] = 'on';
+        $_SERVER['HTTP_X_FORWARDED_PROTO'] = $proto;
+        $this->assertEquals($proto, Url::getCurrentScheme());
+
+        unset($_SERVER['HTTP_X_FORWARDED_PROTO']);
+        unset($_SERVER['HTTPS']);
+    }
+
+    /**
+     * @dataProvider getProtocol
+     */
+    public function test_getCurrentScheme_shouldDetectSecureFromHttpsHeader()
+    {
+        $_SERVER['HTTPS'] = 'on';
+        $this->assertEquals('https', Url::getCurrentScheme());
+
+        unset($_SERVER['HTTPS']);
+    }
+
+    /**
+     * @dataProvider getProtocol
+     */
+    public function test_getCurrentScheme_shouldBeHttpByDefault()
+    {
+        $this->assertEquals('http', Url::getCurrentScheme());
+    }
+
+    public function getProtocol()
+    {
+        return array(array('http'), array('https'));
+    }
+
     /**
      * Dataprovider for testIsLocalUrl
      */