Skip to content

Commit

Permalink
Connection: Loose Comparison for Port Number in Signatures (#14111)
Browse files Browse the repository at this point in the history
When WordPress is hosted behind a reverse proxy, we ask site owners to
add a `X-Forwarded-Port` header from the reverse proxy to the origin so
that Jetpack can know what port to use in the signature's input.

We also allow site owners to define `JETPACK_SIGNATURE__HTTPS_PORT` and
`JETPACK_SIGNATURE__HTTP_PORT` constants if adding a header is not
possible.

Often, site owners will add the following snippet to their wp-config.php
to make use of those constants:

```
define( 'JETPACK_SIGNATURE__HTTP_PORT', $_SERVER['SERVER_PORT'] );
define( 'JETPACK_SIGNATURE__HTTPS_PORT', $_SERVER['SERVER_PORT'] );
```

Unfortunately, we broke that snippet in
Automattic/jetpack#13489, since we moved to strict
comparisons in:
* https://github.com/Automattic/jetpack/blob/97cc7bb9b26d4184ba4915efd5928e59d4456b38/packages/connection/legacy/class-jetpack-signature.php#L95
* https://github.com/Automattic/jetpack/blob/97cc7bb9b26d4184ba4915efd5928e59d4456b38/packages/connection/legacy/class-jetpack-signature.php#L102

`$_SERVER['SERVER_PORT']` is a string in most environments, and the new
code demands integers.

Switch back to loose comparison.
  • Loading branch information
mdawaffe authored and jeherve committed Nov 25, 2019
1 parent 73c314c commit 4834877
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions legacy/class-jetpack-signature.php
Original file line number Diff line number Diff line change
Expand Up @@ -92,15 +92,15 @@ public function sign_current_request( $override = array() ) {
// X-Forwarded-Port and the back end's port is *not* 80. It's better,
// though, to configure the proxy to send X-Forwarded-Port.
$https_port = defined( 'JETPACK_SIGNATURE__HTTPS_PORT' ) ? JETPACK_SIGNATURE__HTTPS_PORT : 443;
$port = in_array( $host_port, array( 443, 80, $https_port ), true ) ? '' : $host_port;
$port = in_array( $host_port, array( 443, 80, $https_port ), false ) ? '' : $host_port; // phpcs:ignore WordPress.PHP.StrictInArray.FoundNonStrictFalse
} else {
// 80: Standard Port
// JETPACK_SIGNATURE__HTTPS_PORT: Set this constant in wp-config.php to the back end webserver's port
// if the site is behind a proxy running on port 80 without
// X-Forwarded-Port. It's better, though, to configure the proxy to
// send X-Forwarded-Port.
$http_port = defined( 'JETPACK_SIGNATURE__HTTP_PORT' ) ? JETPACK_SIGNATURE__HTTP_PORT : 80;
$port = in_array( $host_port, array( 80, $http_port ), true ) ? '' : $host_port;
$port = in_array( $host_port, array( 80, $http_port ), false ) ? '' : $host_port; // phpcs:ignore WordPress.PHP.StrictInArray.FoundNonStrictFalse
}

$this->current_request_url = "{$scheme}://{$_SERVER['HTTP_HOST']}:{$port}" . stripslashes( $_SERVER['REQUEST_URI'] );
Expand Down

0 comments on commit 4834877

Please sign in to comment.