Added proxy headers verification (close #5)

edgardmessias · Jan 12, 2021 · f1a69e2 · f1a69e2
1 parent c37f496
commit f1a69e2
Showing 1 changed file with 21 additions and 3 deletions.
diff --git a/inc/provider.class.php b/inc/provider.class.php
@@ -685,10 +685,28 @@ public function getResourceOwnerDetailsUrl($access_token) {
     * @return string
     */
    private function getBaseURL() {
-      $baseURL = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") ? "https://" : "http://";
-      $baseURL .= $_SERVER["SERVER_NAME"];
+      $baseURL = "";
+      if (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
+         $baseURL = ($_SERVER["HTTP_X_FORWARDED_PROTO"] == "https") ? "https://" : "http://";
+      } else if (isset($_SERVER["HTTPS"])) {
+         $baseURL = ($_SERVER["HTTPS"] == "on") ? "https://" : "http://";
+      } else {
+         $baseURL = "http://";
+      }
+      if (isset($_SERVER["HTTP_X_FORWARDED_HOST"])) {
+         $baseURL .= $_SERVER["HTTP_X_FORWARDED_HOST"];
+      } else if (isset($_SERVER["HTTP_X_FORWARDED_HOST"])) {
+         $baseURL .= $_SERVER["HTTP_X_FORWARDED_HOST"];
+      } else {
+         $baseURL .= $_SERVER["SERVER_NAME"];
+      }
+
+      $port = $_SERVER["SERVER_PORT"];
+      if (isset($_SERVER["HTTP_X_FORWARDED_PORT"])) {
+         $port = $_SERVER["HTTP_X_FORWARDED_PORT"];
+      }
 
-      if ($_SERVER["SERVER_PORT"] != "80" && $_SERVER["SERVER_PORT"] != "443") {
+      if ($port != "80" && $port != "443") {
          $baseURL .= ":" . $_SERVER["SERVER_PORT"];
       }
       return $baseURL;