Merge "Do not redirect to HTTPS when it's not supported"
authorjenkins-bot <jenkins-bot@gerrit.wikimedia.org>
Tue, 31 May 2016 17:39:48 +0000 (17:39 +0000)
committerGerrit Code Review <gerrit@wikimedia.org>
Tue, 31 May 2016 17:39:48 +0000 (17:39 +0000)
1  2 
includes/MediaWiki.php

diff --combined includes/MediaWiki.php
@@@ -667,10 -667,10 +667,10 @@@ class MediaWiki 
                $trxLimits = $this->config->get( 'TrxProfilerLimits' );
                $trxProfiler = Profiler::instance()->getTransactionProfiler();
                $trxProfiler->setLogger( LoggerFactory::getInstance( 'DBPerformance' ) );
 -              if ( $request->wasPosted() ) {
 -                      $trxProfiler->setExpectations( $trxLimits['POST'], __METHOD__ );
 -              } else {
 +              if ( $request->hasSafeMethod() ) {
                        $trxProfiler->setExpectations( $trxLimits['GET'], __METHOD__ );
 +              } else {
 +                      $trxProfiler->setExpectations( $trxLimits['POST'], __METHOD__ );
                }
  
                // If the user has forceHTTPS set to true, or if the user
                // isLoggedIn() will do all sorts of weird stuff.
                if (
                        $request->getProtocol() == 'http' &&
+                       // switch to HTTPS only when supported by the server
+                       preg_match( '#^https://#', wfExpandUrl( $request->getRequestURL(), PROTO_HTTPS ) ) &&
                        (
                                $request->getSession()->shouldForceHTTPS() ||
                                // Check the cookie manually, for paranoia