From 514426e27d9e6c9c7e3882697ea66a57f20a8bc0 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Mon, 17 Dec 2018 12:44:23 +0100 Subject: Only trust the X-FORWARDED-HOST header for trusted proxies Signed-off-by: Roeland Jago Douma --- lib/private/AppFramework/Http/Request.php | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index 2c745973ed2..00668e87e34 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -691,7 +691,7 @@ class Request implements \ArrayAccess, \Countable, IRequest { return $this->config->getSystemValue('overwriteprotocol'); } - if (isset($this->server['HTTP_X_FORWARDED_PROTO'])) { + if ($this->fromTrustedProxy() && isset($this->server['HTTP_X_FORWARDED_PROTO'])) { if (strpos($this->server['HTTP_X_FORWARDED_PROTO'], ',') !== false) { $parts = explode(',', $this->server['HTTP_X_FORWARDED_PROTO']); $proto = strtolower(trim($parts[0])); @@ -862,7 +862,7 @@ class Request implements \ArrayAccess, \Countable, IRequest { */ public function getInsecureServerHost(): string { $host = 'localhost'; - if (isset($this->server['HTTP_X_FORWARDED_HOST'])) { + if ($this->fromTrustedProxy() && isset($this->server['HTTP_X_FORWARDED_HOST'])) { if (strpos($this->server['HTTP_X_FORWARDED_HOST'], ',') !== false) { $parts = explode(',', $this->server['HTTP_X_FORWARDED_HOST']); $host = trim(current($parts)); @@ -924,4 +924,10 @@ class Request implements \ArrayAccess, \Countable, IRequest { return null; } + private function fromTrustedProxy(): bool { + $remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : ''; + $trustedProxies = $this->config->getSystemValue('trusted_proxies', []); + + return \is_array($trustedProxies) && $this->isTrustedProxy($trustedProxies, $remoteAddress); + } } -- cgit v1.2.3