Merge pull request #14261 from nextcloud/show-warning-if-x-forwarded-set-with-empty-trusted-proxies

Warning if x-forwarded-host present but trusted_proxies empty

1 files changed, 6 insertions, 1 deletions

diff --git a/settings/Controller/CheckSetupController.php b/settings/Controller/CheckSetupController.php
index d21874e025d..920bf59ea55 100644
--- a/settings/Controller/CheckSetupController.php
+++ b/settings/Controller/CheckSetupController.php
@@ -289,9 +289,14 @@ class CheckSetupController extends Controller {
 		$trustedProxies = $this->config->getSystemValue('trusted_proxies', []);
 		$remoteAddress = $this->request->getHeader('REMOTE_ADDR');
 
-		if (\is_array($trustedProxies) && \in_array($remoteAddress, $trustedProxies)) {
+		if (empty($trustedProxies) && $this->request->getHeader('X-Forwarded-Host')) {
+			return false;
+		}
+
+		if (\is_array($trustedProxies) && \in_array($remoteAddress, $trustedProxies, true)) {
 			return $remoteAddress !== $this->request->getRemoteAddress();
 		}
+
 		// either not enabled or working correctly
 		return true;
 	}