SSL redirect ignores base_url[<journal_name>] about pkp-lib

[ctgraham]

I tested this in dev-2_4 with rewrites of:

RewriteEngine On
RewriteCond %{REQUEST_URI} !/index.php/
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
RewriteRule ^/index/(.*)$ /index.php/index/$1 [L]

RewriteCond %{REQUEST_URI} !/index.php/
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
RewriteRule ^(.*)$ /index.php/testjournal$1 [L]

and a config.inc.php of:

base_url = "http://my.test.journal/index"
base_url[testjournal] = "http://my.test.journal/"

and either force_ssl or force_login_ssl set to On.

My experience verifies the issue. I haven't gotten down to the cause or fix yet.

[ctgraham]

Why would protocol redirects (https://github.com/pkp/pkp-lib/blob/ojs-dev-2_4/classes/core/PKPRequest.inc.php#L108 and https://github.com/pkp/pkp-lib/blob/ojs-dev-2_4/classes/core/PKPRequest.inc.php#L120) allow for the redirect to be anything other than $_SERVER['REQUEST_URI] with $_SERVER['QUERY_STRING'] appended?

[jprk]

Dne 12. 1. 2015 21:43 "Clinton Graham" [email protected] napsal(a):

Why would protocol redirects (
https://github.com/pkp/pkp-lib/blob/ojs-dev-2_4/classes/core/PKPRequest.inc.php#L108
and
https://github.com/pkp/pkp-lib/blob/ojs-dev-2_4/classes/core/PKPRequest.inc.php#L120)
allow for the redirect to be anything other than $_SERVER['REQUEST_URI]
with $_SERVER['QUERY_STRING'] appended?

I guess that REQUEST_URI is at this moment already remapped to a stateful
URI by simply taking everything after index.php in the original request.
It is just a guess though, I would have to test it (and I will, but
probably not sooner than on Thursday).

I am just wondering whether plain HTTP redirects work in my setup, as the
code for both redirects is almost the same. Also something I will have to
test...

-- Jan

[ctgraham]

Possible URI variants include:

• index.php + querystring
• index.php + PATH_INFO
• mod_rewrite RESTful URL

Regardless of the above cases, I think the REQUEST_URI should be preserved on a protocol redirect.

In OJS 2.4.5, protocol redirects seem to be limited to:

• Login:
  • https://github.com/pkp/pkp-lib/blob/ojs-stable-2_4_5/pages/login/PKPLoginHandler.inc.php#L34
  • https://github.com/pkp/pkp-lib/blob/ojs-stable-2_4_5/pages/login/PKPLoginHandler.inc.php#L69
  • https://github.com/pkp/pkp-lib/blob/ojs-stable-2_4_5/pages/login/PKPLoginHandler.inc.php#L118
• Post login:
  • https://github.com/pkp/pkp-lib/blob/ojs-stable-2_4_5/pages/login/PKPLoginHandler.inc.php#L134
• HTTPS Policy:
  • https://github.com/pkp/pkp-lib/blob/ojs-stable-2_4_5/classes/security/authorization/HttpsPolicy.inc.php#L31

That set still makes me think that the redirect should be based on REQUEST_URI and not on the URI variants. We're really just changing the protocol, not reconstructing the request. I haven't looked at OJS master, or the other PKP products which share lib-pkp, so I'm hoping one of the PKP devs with more experience can chime in.

[asmecher]

Thanks for the detailed investigation, @ctgraham and @jprk -- Clinton, your list of redirects looks correct to me.

The reasons for not using REQUEST_URI are lost in the mists of time, but I suspect it has something to do with that variable not always being available/accurate -- http://stackoverflow.com/questions/12772846/how-reliable-is-serverrequest-uri-at-capturing-query-strings rings a bell for me. This now looks to be a non-issue, however, so I think using REQUEST_URI in these few cases makes a lot of sense.

[asmecher]

(There are probably lots of general opportunities to introduce the use of protocol-relative URLs, by the way.)

[asmecher]

Merged, thanks!

[asmecher]

Also cherry-picked to pkp-lib omp-dev-1_1 and master branches.