Closed (outdated)
Project:
Drupal core
Version:
7.x-dev
Component:
base system
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
24 Sep 2008 at 10:25 UTC
Updated:
3 Jun 2014 at 12:59 UTC
Jump to comment: Most recent
drupal_detect_baseurl() contains functionality that looks like it should closely mirror, or be identical to, some code in conf_path(). Rewriting similar or identical code in separate places in drastically different ways degrades legibility and understandability of the codebase overall.
If the relevant code is intended to be identical in functionality, ensure it is identical in the codebase.
Patch.
None.
None.
In install.php:
function drupal_detect_baseurl($file = 'install.php') {
global $profile;
$proto = $_SERVER['HTTPS'] ? 'https://' : 'http://';
$host = $_SERVER['SERVER_NAME'];
$port = ($_SERVER['SERVER_PORT'] == 80 ? '' : ':' . $_SERVER['SERVER_PORT']);
$uri = preg_replace("/\?.*/", '', $_SERVER['REQUEST_URI']);
$dir = str_replace("/$file", '', $uri);
return "$proto$host$port$dir";
}
in conf_path():
// Create base URL
$base_root = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';
// As $_SERVER['HTTP_HOST'] is user input, ensure it only contains
// characters allowed in hostnames.
$base_url = $base_root .= '://' . preg_replace('/[^a-z0-9-:._]/i', '', $_SERVER['HTTP_HOST']);
// $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
// be modified by a visitor.
if ($dir = trim(dirname($_SERVER['SCRIPT_NAME']), '\,/')) {
$base_path = "/$dir";
$base_url .= $base_path;
$base_path .= '/';
}
else {
$base_path = '/';
}
Comments
Comment #1
arhak commentedis this a bug or kind of code cleanup request?
Comment #2
boaz_r commented1. On this issue see another bug I just posted: #364028
2. Also, the code in conf_path() should omit the isset() check on $_SERVER['HTTPS']. Its redundant. Instead of:
We could use just:
point #1 above (the other bug) relates to this point.
Comment #3
thedavidmeister commentedJust linking the issue in #2 properly #364028: Incorrect checking of https protocol in drupal_detect_baseurl() will lead to problems on IIS.
I can confirm this is NOT an issue in D8 because there is no separate file for installing, we only have bootstrap now.
Comment #4
thedavidmeister commentedComment #5
David_Rothstein commentedAll sorts of issues with this function, apparently.