Revert "Backport #7259 to stable5"

This reverts commit 7bc69c7ea5ca73883ed1b8869929789bf7e85cd7.

diff --git a/config/config.sample.php b/config/config.sample.php
index 77987a574e387dcf6d1c7d7763a29908516745f4..092480d4f5d698db377cd339821b5c28a1bd082b 100755 (executable)
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -53,9 +53,6 @@ $CONFIG = array(
 /* The optional authentication for the proxy to use to connect to the internet. The format is: [username]:[password] */
 "proxyuserpwd" => "",
 
-/* List of trusted domains, to prevent host header poisoning ownCloud is only using these Host headers */
-'trusted_domains' => array('demo.owncloud.org'),
-
 /* Theme to use for ownCloud */
 "theme" => "",
 

diff --git a/lib/request.php b/lib/request.php
index 2a7101efbe1d56c7aa9853ecaa7ec25ab5d6bc1d..d0b2feab311683df3e08f4ded340e3406a05bbdd 100755 (executable)
--- a/lib/request.php
+++ b/lib/request.php
@@ -17,16 +17,6 @@ class OC_Request {
                        or ($type !== 'protocol' and OC_Config::getValue('forcessl', false));
        }
 
-       /**
-       * @brief Checks whether a domain is considered as trusted. This is used to prevent Host Header Poisoning.
-       * @param string $host
-       * @return bool
-        */
-       public static function isTrustedDomain($domain) {
-               $trustedList = \OC_Config::getValue('trusted_domains', array(''));
-               return in_array($domain, $trustedList);
-       }
-
        /**
         * @brief Returns the server host
         * @returns string the server host
@@ -46,28 +36,22 @@ class OC_Request {
                                $host = trim(array_pop(explode(",", $_SERVER['HTTP_X_FORWARDED_HOST'])));
                        }
                        else{
-                               $host = $_SERVER['HTTP_X_FORWARDED_HOST'];
+                               $host=$_SERVER['HTTP_X_FORWARDED_HOST'];
                        }
-               } else {
+               }
+               else{
                        if (isset($_SERVER['HTTP_HOST'])) {
-                               $host = $_SERVER['HTTP_HOST'];
+                               return $_SERVER['HTTP_HOST'];
                        }
                        if (isset($_SERVER['SERVER_NAME'])) {
-                               $host = $_SERVER['SERVER_NAME'];
+                               return $_SERVER['SERVER_NAME'];
                        }
+                       return 'localhost';
                }
-
-               // Verify that the host is a trusted domain if the trusted domains
-               // are defined
-               // If no trusted domain is provided the first trusted domain is returned
-               if(self::isTrustedDomain($host) || \OC_Config::getValue('trusted_domains', "") === "") {
-                       return $host;
-               } else {
-                       $trustedList = \OC_Config::getValue('trusted_domains', array(''));
-                       return $trustedList[0];
-               }
+               return $host;
        }
 
+
        /**
        * @brief Returns the server protocol
        * @returns string the server protocol
@@ -80,14 +64,14 @@ class OC_Request {
                }
                if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
                        $proto = strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']);
-                       // Verify that the protocol is always HTTP or HTTPS
-                       // default to http if an invalid value is provided
-                       return $proto === 'https' ? 'https' : 'http';
-               }
-               if (isset($_SERVER['HTTPS']) && !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
-                       return 'https';
+               }else{
+                       if(isset($_SERVER['HTTPS']) and !empty($_SERVER['HTTPS']) and ($_SERVER['HTTPS']!='off')) {
+                               $proto = 'https';
+                       }else{
+                               $proto = 'http';
+                       }
                }
-               return 'http';
+               return $proto;
        }
 
        /**

diff --git a/lib/setup.php b/lib/setup.php
index d00e860434d4e654969c02194de7d7dd32d21e81..2a43f7b4475c32ace57187d8ef5cde67e4747ffd 100644 (file)
--- a/lib/setup.php
+++ b/lib/setup.php
@@ -84,7 +84,6 @@ class OC_Setup {
                        OC_Config::setValue('passwordsalt', $salt);
 
                        //write the config file
-                       OC_Config::setValue('trusted_domains', array(OC_Request::serverHost())); 
                        OC_Config::setValue('datadirectory', $datadir);
                        OC_Config::setValue('dbtype', $dbtype);
                        OC_Config::setValue('version', implode('.', OC_Util::getVersion()));

diff --git a/lib/updater.php b/lib/updater.php
index ec10377a4b9197658f0fe17222f5f4ace18fc670..d0ae1fb471590ea097fa265dbd117189b2264a57 100644 (file)
--- a/lib/updater.php
+++ b/lib/updater.php
@@ -97,19 +97,6 @@ class OC_Updater extends BasicEmitter {
                $currentVersion = implode('.', \OC_Util::getVersion());
                \OC_Log::write('core', 'starting upgrade from ' . $installedVersion . ' to ' . $currentVersion, \OC_Log::WARN);
                $this->emit('\OC_Updater', 'maintenanceStart');
-
-               /*
-                * START CONFIG CHANGES FOR OLDER VERSIONS
-                */
-               if (version_compare($currentVersion, '5.00.29', '<')) {
-                       // Add the overwriteHost config if it is not existant
-                       // This is added to prevent host header poisoning
-                       \OC_Config::setValue('trusted_domains', \OC_Config::getValue('trusted_domains', array(\OC_Request::serverHost()))); 
-               }
-               /*
-                * STOP CONFIG CHANGES FOR OLDER VERSIONS
-                */
-
                try {
                        \OC_DB::updateDbFromStructure(\OC::$SERVERROOT . '/db_structure.xml');
                        $this->emit('\OC_Updater', 'dbUpgrade');
@@ -170,4 +157,4 @@ class OC_Updater extends BasicEmitter {
                }
                $this->emit('\OC_Updater', 'filecacheDone');
        }
-}
+}
\ No newline at end of file