ENHANCEMENT: Ensure that forceSSL and protocol detection respects the…

… X-Forwarded-Protocol header.
silverstripe · Feb 2, 2012 · 921bf9a · 921bf9a
1 parent bf4476a
commit 921bf9a
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/core/control/Director.php b/core/control/Director.php
@@ -397,6 +397,7 @@ static function protocolAndHost() {
 	 * @return String
 	 */
 	static function protocol() {
+		if(isset($_SERVER['HTTP_X_FORWARDED_PROTOCOL']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTOCOL']) == 'https') return "https://";
 		return (isset($_SERVER['SSL']) || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off')) ? 'https://' : 'http://';
 	}
 
@@ -646,7 +647,7 @@ static function forceSSL($patterns = null) {
 			$matched = true;
 		}
 
-		if($matched && (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off')) {
+		if($matched && (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'off') && !(isset($_SERVER['HTTP_X_FORWARDED_PROTOCOL']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTOCOL']) == 'https')) {
 			$destURL = str_replace('http:', 'https:', Director::absoluteURL($_SERVER['REQUEST_URI']));
 
 			// This coupling to SapphireTest is necessary to test the destination URL and to not interfere with tests