habari/habari — Issue #288: Incorrect detection of HTTPS 'on' in system/classes/site.php
Author: lapsedtheorist
Created: 2012-02-06 19:55:49+00:00
State: open

I've found a problem with the line of code that decides on the protocol to use in Site::get_url('host') - the check against $_SERVER['HTTPS'] needs revising as follows:

diff --git a/classes/site.php b/classes/site.php
index 7048324..e36474e 100644
--- a/classes/site.php
+++ b/classes/site.php
@@ -144,7 +144,7 @@ class Site
if ( ( $port != 80 ) && ( $port != 443 ) && ( MultiByte::substr(
$portpart = ':' . $port;
}
- if ( isset( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] != 'off' )
+ if ( isset( $_SERVER['HTTPS'] ) && $_SERVER['HTTPS'] == 'on' ) {
$protocol = 'https';
}
$url = $protocol . '://' . $host . $portpart;

IIRC, the key 'HTTPS' can be set in $_SERVER even when HTTPS is off and the values it can contain are blank, false, null, 'off' and 'on'. Only the latter should result in $protocol = 'https';

Incidentally, I uncovered this issue from a fresh install of Nginx/1.1.12 on Debian Wheezy - the fastcgi_params file contains HTTPS irrespective of whether the server is using it or not, and if the server isn't using it then the value is blank.

Cheers,
Ben.