|
Thought I would close out the loop myself, hopefully this will help someone, and someone may have some better suggestions!
After far far far too much tracing (there must be an easier way), the we found a fix that involved public function getScheme() in lib/Zend/Controller/Request/Http.php, as follows: (line 1013)
public function getScheme()
{
// MD - Edit for 1.6.2 SSL Loop, original code below.
//return ($this->getServer(’HTTPS’) == ‘on’) ? self::SCHEME_HTTPS : self::SCHEME_HTTP;
return ($_SERVER[’HTTPS’] === null) ? self::SCHEME_HTTP : self::SCHEME_HTTPS;
}
I have changed the logic to pick up the global var if not null, as opposed to ‘on’. However I note that in 1.5 that line had not changed.
However the core issue looks more likely to be in Mage/Core/Controller/Varian/Router/Standard.php
In 1.6.2.0 this reads
/**
* Check if request URL should be secure
*
* Function redirects user to correct URL if needed
*
* @param Mage_Core_Controller_Request_Http $request
* @param string $path
* @return null
*/
protected function _checkShouldBeSecure($request, $path = ‘’)
{
if (!Mage::isInstalled() || $request->getPost()) {
return;
}
if ($this->_shouldBeSecure($path) && !$request->isSecure()) {
$url = $this->_getCurrentSecureUrl($request);
Mage::app()->getFrontController()->getResponse()
->setRedirect($url)
->sendResponse();
exit();
}
}
In 1.5.1.0 this reads:
protected function _checkShouldBeSecure($request, $path=’’)
{
if (!Mage::isInstalled() || $request->getPost()) {
return;
}
if ($this->_shouldBeSecure($path) && !Mage::app()->getStore()->isCurrentlySecure()) {
$url = $this->_getCurrentSecureUrl($request);
Mage::app()->getFrontController()->getResponse()
->setRedirect($url)
->sendResponse();
exit;
}
}
Testing the logical statement && !$request->isSecure(), traces us back through IsSecure, getScheme and getServer to get to the edit made. Testing of the logic, seems to indicate that the output from isSecure would always lead to an incorrect result.
I am not (yet) however aware of the output of !Mage::app()->getStore()->isCurrentlySecure()) and why this was changed between 1.5 and 1.6.
In addition I have explored all around the code in the function, isCurrentlySecure()—and this would seem to take into account the offload headers, however this never appears to be called in 1.6.
I dont like the fact that I have an edit in lib/zend, so do some testing with trying to call isCurrentlySecure, but I cant help but think they have removed the call for a reason - anyone know why this file has been changed ?
Regards,
Martin
|
