Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-22446

AllowedRedirectHosts fix won't work with ports

    Details

      Description

      The AllowedRedirectHost changes implemented in EZP-20052 won't work if you have eZPublish set to work with ports.

      Steps to Reproduce

      1. Install eZPublish with a port based url ( http://my-domain.com:18470 )
      2. Make sure the site has at least two languages. Here I'll use Portuguese and English
      3. Open the frontend ( http://my-domain.com:18470 )
      4. Try to change the language to Portuguese trough the language switcher ( http://my-domain.com:18470/por )
      5. The action will be prevented with "Redirection requested on non-authorized host 'my-domain.com'"

        Issue Links

          Activity

          Hide
          Eduardo Fernandes (Inactive) added a comment - - edited

          The problem seems to be in lib/ezutils/classes/ezmodule.php#L956

          $urlComponents = parse_url( $uri );
          if ( isset( $urlComponents['host'] ) && $urlComponents['host'] !== eZSys::hostname() )
          {
          	$allowedHosts = $this->getAllowedRedirectHosts();
          	if ( !isset( $allowedHosts[$urlComponents['host']] ) )
          

          parse_url function will split the url into host and port.
          eZSys::hostname() will bring the port along.
          When you compare $urlComponents['host'] !== eZSys::hostname(), it will always fail if eZPublish is set with ports.

          Show
          Eduardo Fernandes (Inactive) added a comment - - edited The problem seems to be in lib/ezutils/classes/ezmodule.php#L956 $urlComponents = parse_url( $uri ); if ( isset( $urlComponents['host'] ) && $urlComponents['host'] !== eZSys::hostname() ) { $allowedHosts = $this->getAllowedRedirectHosts(); if ( !isset( $allowedHosts[$urlComponents['host']] ) ) parse_url function will split the url into host and port. eZSys::hostname() will bring the port along. When you compare $urlComponents ['host'] !== eZSys::hostname(), it will always fail if eZPublish is set with ports.
          Show
          Joao Inacio (Inactive) added a comment - Possible Fix: https://github.com/ezsystems/ezpublish-legacy/pull/899
          Show
          Jérôme Vieilledent (Inactive) added a comment - PR: https://github.com/ezsystems/ezpublish-legacy/pull/903
          Show
          Jérôme Vieilledent (Inactive) added a comment - Fixed in master: https://github.com/ezsystems/ezpublish-legacy/commit/1bd0d1c1f521af3e5bc37e8b8e1bb38b3a4a67b0
          Hide
          Joao Pingo (Inactive) added a comment -

          QA Approved

          Show
          Joao Pingo (Inactive) added a comment - QA Approved

            People

            • Assignee:
              Unassigned
              Reporter:
              Eduardo Fernandes (Inactive)
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 6 hours
                6h