diff options
| author | Roeland Jago Douma <roeland@famdouma.nl> | 2018-12-17 12:44:23 +0100 |
|---|---|---|
| committer | Roeland Jago Douma <roeland@famdouma.nl> | 2018-12-17 15:54:45 +0100 |
| commit | 514426e27d9e6c9c7e3882697ea66a57f20a8bc0 (patch) | |
| tree | 0e486605c7b09879b4594fb52fac8062d6e7cd14 /lib/private/AppFramework/Http | |
| parent | 6788e6e75cca95357a64202d331bf61e975df7d3 (diff) | |
| download | nextcloud-server-514426e27d9e6c9c7e3882697ea66a57f20a8bc0.tar.gz nextcloud-server-514426e27d9e6c9c7e3882697ea66a57f20a8bc0.zip | |
Only trust the X-FORWARDED-HOST header for trusted proxies
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Diffstat (limited to 'lib/private/AppFramework/Http')
| -rw-r--r-- | lib/private/AppFramework/Http/Request.php | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index 2c745973ed2..00668e87e34 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -691,7 +691,7 @@ class Request implements \ArrayAccess, \Countable, IRequest { return $this->config->getSystemValue('overwriteprotocol'); } - if (isset($this->server['HTTP_X_FORWARDED_PROTO'])) { + if ($this->fromTrustedProxy() && isset($this->server['HTTP_X_FORWARDED_PROTO'])) { if (strpos($this->server['HTTP_X_FORWARDED_PROTO'], ',') !== false) { $parts = explode(',', $this->server['HTTP_X_FORWARDED_PROTO']); $proto = strtolower(trim($parts[0])); @@ -862,7 +862,7 @@ class Request implements \ArrayAccess, \Countable, IRequest { */ public function getInsecureServerHost(): string { $host = 'localhost'; - if (isset($this->server['HTTP_X_FORWARDED_HOST'])) { + if ($this->fromTrustedProxy() && isset($this->server['HTTP_X_FORWARDED_HOST'])) { if (strpos($this->server['HTTP_X_FORWARDED_HOST'], ',') !== false) { $parts = explode(',', $this->server['HTTP_X_FORWARDED_HOST']); $host = trim(current($parts)); @@ -924,4 +924,10 @@ class Request implements \ArrayAccess, \Countable, IRequest { return null; } + private function fromTrustedProxy(): bool { + $remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : ''; + $trustedProxies = $this->config->getSystemValue('trusted_proxies', []); + + return \is_array($trustedProxies) && $this->isTrustedProxy($trustedProxies, $remoteAddress); + } } |