more reliable host detection for reverse proxy servers

diff --git a/lib/base.php b/lib/base.php
index bdfd05e8f1d544a6458a0b5c6598f2d9fc65f29d..b9c28119e32915adafa02f851db23976d141f3a7 100644 (file)
--- a/lib/base.php
+++ b/lib/base.php
@@ -367,16 +367,18 @@ class OC{
 
                // CSRF protection
                if(isset($_SERVER['HTTP_REFERER'])) $referer=$_SERVER['HTTP_REFERER']; else $referer='';
-               $protocol=OC_Helper::serverProtocol().'://'; 
+               $refererhost=parse_url($referer);
+               if(isset($refererhost['host'])) $refererhost=$refererhost['host']; else $refererhost='';
+               $server=OC_Helper::serverHost();
+               $serverhost=parse_url($server);
+               if(isset($serverhost['host'])) $serverhost=$serverhost['host']; else $serverhost='';
                if(!self::$CLI){
-                       $server=$protocol.OC_Helper::serverHost();
-                       if(($_SERVER['REQUEST_METHOD']=='POST') and (substr($referer,0,strlen($server))<>$server)) {
-                               $url = $protocol.OC_Helper::serverProtocol().OC::$WEBROOT.'/index.php';
+                       if(($_SERVER['REQUEST_METHOD']=='POST') and ($refererhost<>$serverhost)) {
+                               $url = OC_Helper::serverProtocol().'://'.$server.OC::$WEBROOT.'/index.php';
                                header("Location: $url");
                                exit();
                        }
                }
-
                self::initSession();
                self::initTemplateEngine();
                self::checkUpgrade();

diff --git a/lib/helper.php b/lib/helper.php
index aedac2040586057f45da5f94af7e61737e43e7f2..decc1d61336f6fbe5450c6ce1a29aa4d4a285dc5 100644 (file)
--- a/lib/helper.php
+++ b/lib/helper.php
@@ -120,7 +120,7 @@ class OC_Helper {
         */
        public static function linkToAbsolute( $app, $file ) {
                $urlLinkTo = self::linkTo( $app, $file );
-               $urlLinkTo = OC_Helper::serverProtocol(). '://'  . self::serverHost() . $urlLinkTo;
+               $urlLinkTo = self::serverProtocol(). '://'  . self::serverHost() . $urlLinkTo;
                return $urlLinkTo;
        }