diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc index be8c695..e808a87 100644 --- a/core/includes/bootstrap.inc +++ b/core/includes/bootstrap.inc @@ -547,6 +547,17 @@ function drupal_settings_initialize() { } new Settings(isset($settings) ? $settings : array()); + // If Drupal is behind a reverse proxy or load balancer that is communicating + // with the end-user over https but with Drupal over http we will generate a + // broken $base_path unless we set $_SERVER['HTTPS'] to 'on'. Trusting these + // headers is a potential security risk so we only do so if + // $settings['reverse_proxy'] has been set. + if (settings()->get('reverse_proxy')) { + // X-Forwarded-Proto is the most common convention for protocol information. + if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https') { + $_SERVER['HTTPS'] = 'on'; + } + } $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on'; if (isset($base_url)) {