From 49eaeb17e3d46454f6fee79175d88e724ccf37ed Mon Sep 17 00:00:00 2001 From: Avatarsia Date: Wed, 10 Jun 2026 22:10:00 +0200 Subject: [PATCH] location: fix broken redirects behind reverse proxy (https://host:80) Location::__construct() built the absolute redirect URL from SERVER_NAME and SERVER_PORT, always appending the port. Behind a TLS-terminating reverse proxy (nginx/openresty -> backend on port 80, X-Forwarded-Proto: https) every Location redirect pointed to https://host:80/... - the browser then attempts a TLS handshake against the plain-HTTP port and fails with an SSL error. Prefer HTTP_HOST (host and port exactly as the client addressed them, same as the existing nginx "_" special case) and only fall back to SERVER_NAME, appending SERVER_PORT solely for non-standard ports. Co-Authored-By: Claude Fable 5 --- www/lib/class.location.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/www/lib/class.location.php b/www/lib/class.location.php index 5911159fd..dc9c4787b 100644 --- a/www/lib/class.location.php +++ b/www/lib/class.location.php @@ -37,8 +37,15 @@ public function __construct($app) if($_SERVER['SERVER_NAME'] === '_' && !empty($_SERVER['HTTP_HOST'])){ // Sonderfall für Nginx mit Servername "_" $server = $REQUEST_PROTOCOL.'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; + }elseif(!empty($_SERVER['HTTP_HOST'])){ + // HTTP_HOST enthält Host und ggf. Port so, wie der Client sie adressiert hat. + // SERVER_PORT wäre hinter einem Reverse Proxy der interne Port (z.B. 80) und + // ergäbe mit https kaputte Redirects wie https://host:80/... + $server = $REQUEST_PROTOCOL.'://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; }else{ - $server = $REQUEST_PROTOCOL.'://'.$_SERVER['SERVER_NAME'].':'.$_SERVER['SERVER_PORT'].$_SERVER['REQUEST_URI']; + $server = $REQUEST_PROTOCOL.'://'.$_SERVER['SERVER_NAME']. + ($_SERVER['SERVER_PORT'] != 80 && $_SERVER['SERVER_PORT'] != 443 ? ':'.$_SERVER['SERVER_PORT'] : ''). + $_SERVER['REQUEST_URI']; } }elseif(!empty($_SERVER['REQUEST_URI']) && !empty($_SERVER['SERVER_ADDR']) && !empty($_SERVER['SCRIPT_NAME']) && $_SERVER['SERVER_ADDR']!=='::1' && strpos($_SERVER['SERVER_SOFTWARE'],'nginx')===false