Merge branch '3.4' into 4.1
* 3.4: [HttpKernel] fix forwarding trusted headers as server parameters
This commit is contained in:
commit
3ac90c172a
@ -1991,7 +1991,7 @@ class Request
|
||||
if ($i) {
|
||||
$clientIps[$key] = $clientIp = substr($clientIp, 0, $i);
|
||||
}
|
||||
} elseif ('[' == $clientIp[0]) {
|
||||
} elseif (0 === strpos($clientIp, '[')) {
|
||||
// Strip brackets and :port from IPv6 addresses.
|
||||
$i = strpos($clientIp, ']', 1);
|
||||
$clientIps[$key] = $clientIp = substr($clientIp, 1, $i - 1);
|
||||
|
@ -906,7 +906,7 @@ class RequestTest extends TestCase
|
||||
|
||||
public function getClientIpsProvider()
|
||||
{
|
||||
// $expected $remoteAddr $httpForwardedFor $trustedProxies
|
||||
// $expected $remoteAddr $httpForwardedFor $trustedProxies
|
||||
return array(
|
||||
// simple IPv4
|
||||
array(array('88.88.88.88'), '88.88.88.88', null, null),
|
||||
@ -920,8 +920,8 @@ class RequestTest extends TestCase
|
||||
|
||||
// forwarded for with remote IPv4 addr not trusted
|
||||
array(array('127.0.0.1'), '127.0.0.1', '88.88.88.88', null),
|
||||
// forwarded for with remote IPv4 addr trusted
|
||||
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1')),
|
||||
// forwarded for with remote IPv4 addr trusted + comma
|
||||
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88,', array('127.0.0.1')),
|
||||
// forwarded for with remote IPv4 and all FF addrs trusted
|
||||
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1', '88.88.88.88')),
|
||||
// forwarded for with remote IPv4 range trusted
|
||||
|
@ -41,6 +41,7 @@ class SubRequestHandler
|
||||
);
|
||||
foreach (array_filter($trustedHeaders) as $name => $key) {
|
||||
$request->headers->remove($name);
|
||||
$request->server->remove('HTTP_'.$name);
|
||||
}
|
||||
}
|
||||
|
||||
@ -59,13 +60,16 @@ class SubRequestHandler
|
||||
// set trusted values, reusing as much as possible the global trusted settings
|
||||
if (Request::HEADER_FORWARDED & $trustedHeaderSet) {
|
||||
$trustedValues[0] .= sprintf(';host="%s";proto=%s', $request->getHttpHost(), $request->getScheme());
|
||||
$request->headers->set('Forwarded', implode(', ', $trustedValues));
|
||||
$request->headers->set('Forwarded', $v = implode(', ', $trustedValues));
|
||||
$request->server->set('HTTP_FORWARDED', $v);
|
||||
}
|
||||
if (Request::HEADER_X_FORWARDED_FOR & $trustedHeaderSet) {
|
||||
$request->headers->set('X-Forwarded-For', implode(', ', $trustedIps));
|
||||
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
|
||||
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
|
||||
} elseif (!(Request::HEADER_FORWARDED & $trustedHeaderSet)) {
|
||||
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet | Request::HEADER_X_FORWARDED_FOR);
|
||||
$request->headers->set('X-Forwarded-For', implode(', ', $trustedIps));
|
||||
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
|
||||
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
|
||||
}
|
||||
|
||||
// fix the client IP address by setting it to 127.0.0.1,
|
||||
|
@ -45,6 +45,8 @@ class InlineFragmentRendererTest extends TestCase
|
||||
$subRequest->attributes->replace(array('object' => $object, '_format' => 'html', '_controller' => 'main_controller', '_locale' => 'en'));
|
||||
$subRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$subRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
|
||||
$subRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
$subRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
|
||||
|
||||
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($subRequest));
|
||||
|
||||
@ -57,6 +59,7 @@ class InlineFragmentRendererTest extends TestCase
|
||||
|
||||
$expectedSubRequest = Request::create('/');
|
||||
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
|
||||
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
|
||||
$this->assertSame('foo', $strategy->render('/', Request::create('/'))->getContent());
|
||||
@ -149,8 +152,10 @@ class InlineFragmentRendererTest extends TestCase
|
||||
|
||||
if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
|
||||
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
}
|
||||
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
|
||||
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
|
||||
|
||||
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
|
||||
|
||||
@ -173,6 +178,8 @@ class InlineFragmentRendererTest extends TestCase
|
||||
$expectedSubRequest = Request::create('/');
|
||||
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
|
||||
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
|
||||
|
||||
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
|
||||
$request = Request::create('/', 'GET', array(), array(), array(), array('HTTP_IF_MODIFIED_SINCE' => 'Fri, 01 Jan 2016 00:00:00 GMT', 'HTTP_IF_NONE_MATCH' => '*'));
|
||||
@ -188,6 +195,8 @@ class InlineFragmentRendererTest extends TestCase
|
||||
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
|
||||
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
|
||||
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
|
||||
|
||||
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
|
||||
|
||||
@ -205,6 +214,8 @@ class InlineFragmentRendererTest extends TestCase
|
||||
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
|
||||
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
|
||||
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
|
||||
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
|
||||
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
|
||||
|
||||
Request::setTrustedProxies(array('1.1.1.1/24'), -1);
|
||||
|
||||
|
Reference in New Issue
Block a user