BUGFIX: http-getselfurl-robust-path-and-query #2589
Merged
+83
−12
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Improve HTTP::getSelfURL() path detection and URL reconstruction
HTTP::getSelfURL()mis-reconstructs the current URL when SimpleSAMLphp is accessed through a rewritten path such asRewriteRule ^/cas/login(.*) /${SSP_APACHE_ALIAS}module.php/casserver/login.php$1 [PT]. In this scenario the public URL is/cas/login?service=..., while Apache internally rewrites it to/simplesaml/module.php/casserver/login.php?service=.... The old implementation assumes that the script-relative filesystem path (for examplemodule.php/casserver/login.php) appears verbatim in$_SERVER['REQUEST_URI'], searches for that substring in the entireREQUEST_URI, and rebuilds the URL by stitching togethergetBaseURL(), that matched path, and the remainder ofREQUEST_URI. With mod_rewrite,REQUEST_URIcontains only the external path (/cas/login?...), so the expected script path is not present, or may only appear by accident inside query parameters. This causesgetSelfURL()to either fall back to an incorrect URL or to construct one that points tomodule.php/...instead of/cas/login, or that has a malformed path/query combination, breaking redirects and return URLs that rely ongetSelfURL()to reflect the actual public URL.