is_ssl() does not work on cloud hosting

[mdawart]

On our clients cloud hosting the $_SERVERHTTPS? nor '443' == $_SERVERSERVER_PORT? is set so wordpress is not able to determine if calles via https or not and activating the force ssl setting leads to a redirect loop.

I've modified the is_ssl function to detect for environments like those:

/**
 * Determine if SSL is used.
 *
 * @since 2.6.0
 *
 * @return bool True if SSL, false if not used.
 */
function is_ssl() {
	if ( isset($_SERVER['HTTPS']) ) {
		if ( 'on' == strtolower($_SERVER['HTTPS']) )
			return true;
		if ( '1' == $_SERVER['HTTPS'] )
			return true;
	} elseif ( isset($_SERVER['SERVER_PORT']) && ( '443' == $_SERVER['SERVER_PORT'] ) ) {
		return true;
	} elseif (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && ( 'https' == $_SERVER['HTTP_X_FORWARDED_PROTO'] )) {
		return true;
	}
	return false;
}

[chriscct7]

There should really be a filter in there, perhaps 2 (one general one at the bottom and one earlier that does isset SERVER PORT so it can check a custom https port).

Also

// if site is set to run on SSL, then force-enable SSL detection!
if (stripos(get_option('siteurl'), 'https://') === 0) {
    $_SERVER['HTTPS'] = 'on';
}

Needs to be a patch file. Will review and work on this a bit.

[chriscct7]

Related #19654, #19337, #15733

[chriscct7]

If port for HTTPS is used set SERVER var

[chriscct7]

This needs to be reviewed extensively before merge

[dd32]

Duplicate of #31288.

I don't believe we can trust the HTTP_X_FORWARDED_PROTO variable, as clients can set it, bypassing any checks which rely upon is_ssl().

The correct method is to either
a) Fix the server variables in the server to reflect the upstream proxy
b) Fix the server variables in wp-config.php to reflect the upstream proxy

You can see my full reasoning here: https://core.trac.wordpress.org/ticket/31288#comment:11

[chriscct7]

Makes sense

[tsaweb]

Estou com uma problema de (error 500), onde não está exibindo o site do cliente ​https://descubraoguaruja.com.br.

A hospedagem acusou erro nos arquivos (functions.php) e (load.php), que acusa erro na linha onde a função verifica a existencia de SSL.

Alguém já passou por esse problema?