Problem/Motivation
drupal_detect_baseurl() contains functionality that looks like it should closely mirror, or be identical to, some code in conf_path(). Rewriting similar or identical code in separate places in drastically different ways degrades legibility and understandability of the codebase overall.
Proposed resolution
If the relevant code is intended to be identical in functionality, ensure it is identical in the codebase.
Remaining tasks
Patch.
User interface changes
None.
API changes
None.
Original report by @Damien Tournoud
In install.php:
function drupal_detect_baseurl($file = 'install.php') {
global $profile;
$proto = $_SERVER['HTTPS'] ? 'https://' : 'http://';
$host = $_SERVER['SERVER_NAME'];
$port = ($_SERVER['SERVER_PORT'] == 80 ? '' : ':' . $_SERVER['SERVER_PORT']);
$uri = preg_replace("/\?.*/", '', $_SERVER['REQUEST_URI']);
$dir = str_replace("/$file", '', $uri);
return "$proto$host$port$dir";
}
in conf_path():
// Create base URL
$base_root = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 'https' : 'http';
// As $_SERVER['HTTP_HOST'] is user input, ensure it only contains
// characters allowed in hostnames.
$base_url = $base_root .= '://' . preg_replace('/[^a-z0-9-:._]/i', '', $_SERVER['HTTP_HOST']);
// $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
// be modified by a visitor.
if ($dir = trim(dirname($_SERVER['SCRIPT_NAME']), '\,/')) {
$base_path = "/$dir";
$base_url .= $base_path;
$base_path .= '/';
}
else {
$base_path = '/';
}
Comments
Comment #1
arhak commentedis this a bug or kind of code cleanup request?
Comment #2
boaz_r commented1. On this issue see another bug I just posted: #364028
2. Also, the code in conf_path() should omit the isset() check on $_SERVER['HTTPS']. Its redundant. Instead of:
We could use just:
point #1 above (the other bug) relates to this point.
Comment #3
thedavidmeister commentedJust linking the issue in #2 properly #364028: Incorrect checking of https protocol in drupal_detect_baseurl() will lead to problems on IIS.
I can confirm this is NOT an issue in D8 because there is no separate file for installing, we only have bootstrap now.
Comment #4
thedavidmeister commentedComment #5
David_Rothstein commentedAll sorts of issues with this function, apparently.