View Issue Detail

ID	Project	Category	Submitted / Last Updated
01515	UserSpice	Triage	2022-05-15 19:33:03 / 2022-08-28 18:33:21
Reported	Tekniskedirektorn	Assigned To	Unassigned
Priority	none	Reported	5.2.2
Status	closed fixed	Resolution Version and Commit	5.4.5
Summary	Detect and redirect too HTTPS without $_SERVER['HTTPS']
Description	Don't know if this has been fixed lately but on many proxied servers and load balanced $_SERVER['HTTPS'] does not exist so therefore we need to check elsewhere for https. Suggestion: replace this: if ($settings->force_ssl==1){ if (!isset($_SERVER['HTTPS']) \|\| !$_SERVER['HTTPS']) { // if request is not secure, redirect to secure url $url = 'https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; Redirect::to($url); exit; } } with this if ($settings->force_ssl==1){ $isSecure = false; if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') { $isSecure = true; } elseif (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' \|\| !empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on') { $isSecure = true; } if ($isSecure != true) { // if request is not secure, redirect to secure url $url = 'https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; Redirect::to($url); exit; } }