diff options
author | Andrew Dolgov <[email protected]> | 2021-02-26 14:14:44 +0300 |
---|---|---|
committer | Andrew Dolgov <[email protected]> | 2021-02-26 14:14:44 +0300 |
commit | e6a875b7e4e4b179284942878da452a8db8d9b50 (patch) | |
tree | cb00401ab3e44404b4305af99ede8faf8bcd49a0 /classes/rpc.php | |
parent | 4896874bda76536e29a10a5f7c1ee0fcd40dd201 (diff) |
check if client-presented URL scheme is different from one configured in SELF_URL_PATH
Diffstat (limited to 'classes/rpc.php')
-rwxr-xr-x | classes/rpc.php | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/classes/rpc.php b/classes/rpc.php index aaaf4f8d5..630ea50cb 100755 --- a/classes/rpc.php +++ b/classes/rpc.php @@ -168,10 +168,21 @@ class RPC extends Handler_Protected { $_SESSION["hasSandbox"] = clean($_REQUEST["hasSandbox"]) === "true"; $_SESSION["clientTzOffset"] = clean($_REQUEST["clientTzOffset"]); + $client_location = $_REQUEST["clientLocation"]; + $error = Errors::E_SUCCESS; + $error_params = []; + + $client_scheme = parse_url($client_location, PHP_URL_SCHEME); + $server_scheme = parse_url(get_self_url_prefix(), PHP_URL_SCHEME); if (get_schema_version() != SCHEMA_VERSION) { $error = Errors::E_SCHEMA_MISMATCH; + } else if ($client_scheme != $server_scheme) { + $error = Errors::E_URL_SCHEME_MISMATCH; + $error_params["client_scheme"] = $client_scheme; + $error_params["server_scheme"] = $server_scheme; + $error_params["self_url_path"] = get_self_url_prefix(); } if ($error == Errors::E_SUCCESS) { @@ -183,7 +194,7 @@ class RPC extends Handler_Protected { print json_encode($reply); } else { - print Errors::to_json($error); + print Errors::to_json($error, $error_params); } } |