Details
-
Bug
-
Resolution: Fixed
-
Medium
-
None
-
4.0.0, 4.0.1rc1
-
None
-
Operating System: Ubuntu Server 8.04.1, FreeBSD
PHP Version: 5.2.1+ (different servers)
Description
In all recent versions, including 4.0.0 and 4.0.2RC2, there's a problem with coming back from SSL zone to a plain HTTP zone (the redirection works fine in the opposite direction, though). After some investigation I found a way of making it work (at least for fresh 4.0.x installation with standard configuration):
In the file /kernel/classes/ezsslzone.php, method switchIfNeeded( $inSSL ), I replaced the following lines:
if ( $nowSSL && !$inSSL ) { // switch to plain HTTP $ini = eZINI::instance(); $host = $ini->variable( 'SiteSettings', 'SiteURL' ); $sslZoneRedirectionURL = "http://" . $host . $indexDir . $requestURI; } elseif ( !$nowSSL && $inSSL ) { // switch to HTTPS $host = eZSys::serverVariable( 'HTTP_HOST' ); $host = preg_replace( '/:\d+$/', '', $host ); $ini = eZINI::instance(); $sslPort = $ini->variable( 'SiteSettings', 'SSLPort' ); $sslPortString = ( $sslPort == eZSSLZone::DEFAULT_SSL_PORT ) ? '' : ":$sslPort"; $sslZoneRedirectionURL = "https://" . $host . $sslPortString . $indexDir . $requestURI; }
if ( $nowSSL && !$inSSL ) { // switch to HTTP $host = eZSys::serverVariable( 'HTTP_HOST' ); $host = preg_replace( '/:\d+$/', '', $host ); $sslZoneRedirectionURL = "http://" . $host . $indexDir . $requestURI; } elseif ( !$nowSSL && $inSSL ) { // switch to HTTPS $host = eZSys::serverVariable( 'HTTP_HOST' ); $host = preg_replace( '/:\d+$/', '', $host ); $ini = eZINI::instance(); $sslPort = $ini->variable( 'SiteSettings', 'SSLPort' ); $sslPortString = ( $sslPort == eZSSLZone::DEFAULT_SSL_PORT ) ? '' : ":$sslPort"; $sslZoneRedirectionURL = "https://" . $host . $sslPortString . $indexDir . $requestURI; }
I didn't quite understand why figuring out host name should take two different ways, depending on whether we're switching http->https or https->http...
It also caught my attention that eZSys::RequestURI() would have inconsistent value, this can be observed when jumping between SSL/nonSSL zones, with var_dump on the RequestURI. However, the above modifications turned out to be sufficient to cope with the problem (or at least it seems so right now).
It would be great to get work for 4.0.1!