Hello, it seems that joomla 3.9.11
$url = JRoute::_($url, false, true);
returnes non-https URL address while previous joomla's always returned https URL for this call.
is it possible that JRoute implements this backward compatiblity ? i see new JRoute uses constants for 3rd parameter, but since this is a quite security related function i would suggest to add backward compatibility to this case.
i guess it is common that the third parameter can be:
to enable the https URL.
best regards, stan
Labels |
Added:
J3 Issue
|
Status | New | ⇒ | Information Required |
hello, i tested on 2 different servers now :
echo JRoute::_('index.php', false, true)."\n"; //returns http:
echo JRoute::_('index.php', false, false)."\n"; //returns relative
echo JRoute::_('index.php', false, 1)."\n"; //return https:
echo JRoute::_('index.php', false, '1')."\n"; //returns https:
echo JRoute::_('index.php', false, JROUTE::TLS_DISABLE)."\n"; debug_zval_dump(JROUTE::TLS_DISABLE); //returns http:
echo JRoute::_('index.php', false, JROUTE::TLS_FORCE)."\n"; debug_zval_dump(JROUTE::TLS_FORCE); //returns https:
echo JRoute::_('index.php', false, JROUTE::TLS_IGNORE)."\n"; debug_zval_dump(JROUTE::TLS_IGNORE); //returns relative
stan
and for the true boolean I always get non-https reply
this is on PHP7.3 , 7.2, 7.1, 7.0 and 5.6
stan
i just debugged this and used:
if ($tls == -1)
{
if ($tls === true) {
die('x');
}
$tls = self::TLS_DISABLE;
}
if $tls === true it also evaluates to $tls == -1
i did not know about this, but this is what's causing the problem
stan
so it gets disabled before it reaches conversion to int
Status | Information Required | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-08-30 12:07:33 |
Closed_By | ⇒ | zero-24 |
Status | Closed | ⇒ | Discussion |
Closed_Date | 2019-08-30 12:07:33 | ⇒ | |
Closed_By | zero-24 | ⇒ |
reopened @franz-wohlkoenig ?
ups, sorry.
Status | Discussion | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-08-30 12:12:48 |
Closed_By | ⇒ | franz-wohlkoenig |
hmm the required b/c code has been introduced in 3.9.11 (by #25225 in response to: #25204):
https://github.com/joomla/joomla-cms/blob/staging/libraries/src/Router/Route.php#L72-L93
based on that the signature you proposed here it should still work than expected as
please double check the signature you use and the joomla version let us know which it is so we replicate the issue.