Verify the HTTPS support within the system check

diff --git a/wcfsetup/install/files/acp/templates/systemCheck.tpl b/wcfsetup/install/files/acp/templates/systemCheck.tpl
index 4d7e9bae99fc4cb15bc956254f98ecf20af88c65..eaab63407c07d178b69ca997aa5c2da405262a69 100644 (file)
--- a/wcfsetup/install/files/acp/templates/systemCheck.tpl
+++ b/wcfsetup/install/files/acp/templates/systemCheck.tpl
@@ -13,6 +13,17 @@
 <section class="section">
        <h2 class="sectionTitle">{lang}wcf.acp.systemCheck.result{/lang}</h2>
        
+       <dl{if !$results[status][web]} class="formError"{/if}>
+               <dt>{lang}wcf.acp.systemCheck.web{/lang}</dt>
+               <dd>
+                       {if $results[status][web]}
+                               {@$statusOk} {lang}wcf.acp.systemCheck.pass{/lang}
+                       {else}
+                               {@$statusInsufficient} {lang}wcf.acp.systemCheck.insufficient{/lang}
+                       {/if}
+               </dd>
+       </dl>
+       
        <dl{if !$results[status][php]} class="formError"{/if}>
                <dt>{lang}wcf.acp.systemCheck.php{/lang}</dt>
                <dd>
@@ -51,6 +62,22 @@
        </dl>
 </section>
 
+<section class="section">
+       <h2 class="sectionTitle">{lang}wcf.acp.systemCheck.web{/lang}</h2>
+       
+       <dl{if !$results[web][https]} class="formError"{/if}>
+               <dt>{lang}wcf.acp.systemCheck.web.https{/lang}</dt>
+               <dd>
+                       {if $results[web][https]}
+                               {@$statusOk} {lang}wcf.acp.systemCheck.pass{/lang}
+                       {else}
+                               {@$statusInsufficient} {lang}wcf.acp.systemCheck.notSupported{/lang}
+                       {/if}
+                       <small>{lang}wcf.acp.systemCheck.web.https.description{/lang}</small>
+               </dd>
+       </dl>
+</section>
+
 <section class="section">
        <h2 class="sectionTitle">{lang}wcf.acp.systemCheck.php{/lang}</h2>
        

diff --git a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
index 19278c61bd7087bf8cba2b5a05326b4998d4b8c2..450f2b8e0e226195608737d29bc599157a36c3db 100644 (file)
--- a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
@@ -8,6 +8,7 @@ use wcf\system\database\util\PreparedStatementConditionBuilder;
 use wcf\system\Environment;
 use wcf\system\exception\SystemException;
 use wcf\system\registry\RegistryHandler;
+use wcf\system\request\RouteHandler;
 use wcf\system\WCF;
 use wcf\util\FileUtil;
 
@@ -150,10 +151,14 @@ class SystemCheckPage extends AbstractPage
             ],
             'x64' => false,
         ],
+        'web' => [
+            'https' => false,
+        ],
         'status' => [
             'directories' => false,
             'mysql' => false,
             'php' => false,
+            'web' => false,
         ],
     ];
 
@@ -184,6 +189,7 @@ class SystemCheckPage extends AbstractPage
         $this->validatePhpVersion();
         $this->validatePhpGdSupport();
         $this->validateWritableDirectories();
+        $this->validateWebHttps();
 
         if (
             $this->results['status']['mysql']
@@ -449,4 +455,14 @@ class SystemCheckPage extends AbstractPage
 
         return true;
     }
+
+    /**
+     * @since 6.1
+     */
+    protected function validateWebHttps(): void
+    {
+        $this->results['web']['https'] = RouteHandler::secureContext();
+
+        $this->results['status']['web'] = $this->results['web']['https'];
+    }
 }

diff --git a/wcfsetup/install/files/lib/system/request/RouteHandler.class.php b/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
index f4ba8ce1977b1a3ccdddd750d58e3029007a45a3..adb6c970f35150d383883ef65712703e205a4644 100644 (file)
--- a/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
+++ b/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
@@ -263,6 +263,34 @@ final class RouteHandler extends SingletonFactory
         return self::$secure;
     }
 
+    /**
+     * Returns true if the current environment is treated as a secure context by
+     * browsers.
+     *
+     * @see https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure
+     * @since 6.1
+     */
+    public static function secureContext(): bool
+    {
+        static $secureContext = null;
+        if ($secureContext === null) {
+            $secureContext = self::secureConnection();
+
+            // The connection is considered as secure if it is encrypted with
+            // TLS, or if the target host is a local address.
+            if (!$secureContext) {
+                $host = $_SERVER['HTTP_HOST'];
+
+                // @see https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-let-localhost-be-localhost-02
+                if ($host === '127.0.0.1' || $host === 'localhost' || \str_ends_with($host, '.localhost')) {
+                    $secureContext = true;
+                }
+            }
+        }
+
+        return $secureContext;
+    }
+
     /**
      * Returns HTTP protocol, either 'http://' or 'https://'.
      */

diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 14e58e9993d5a8a90d376346a68c76cc9215bf09..c32ac3c70623f954ea7a24b2eeb73271593bba96 100644 (file)
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -2815,6 +2815,9 @@ Abschnitte dürfen nicht leer sein und nur folgende Zeichen enthalten: <kbd>[a-z
                <item name="wcf.acp.systemCheck.php.opcache"><![CDATA[OPcache]]></item>
                <item name="wcf.acp.systemCheck.php.opcache.description"><![CDATA[PHPs OPcache beschleunigt die Bearbeitung von Anfragen, indem der vorverarbeitete Programmcode gecached wird. Bei aktiviertem OPcache müssen die Verwaltungsfunktionen <kbd>opcache_reset()</kbd> und <kbd>opcache_invalidate()</kbd> zur Verfügung stehen, damit der Cache nach einer Aktualisierung des Programmcodes zuverlässig neu aufgebaut werden kann.]]></item>
                <item name="wcf.acp.systemCheck.php.opcache.broken"><![CDATA[Fehlerhaft – die Verwaltungsfunktionen sind nicht verfügbar]]></item>
+               <item name="wcf.acp.systemCheck.web"><![CDATA[Webserver]]></item>
+               <item name="wcf.acp.systemCheck.web.https"><![CDATA[Aufruf per HTTPS/TLS]]></item>
+               <item name="wcf.acp.systemCheck.web.https.description"><![CDATA[Neue Funktionen in Webbrowsern werden nur beim Aufruf über HTTPS/TLS unterstützt, bei unverschlüsselten Verbindungen fehlen wichtige Funktionen.]]></item>
        </category>
        <category name="wcf.acp.updateServer">
                <item name="wcf.acp.updateServer.add"><![CDATA[Server hinzufügen]]></item>

diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 1e3c827129e94bfb3f3ad7077385df18a4f7dc36..220bf4155234fec565402abbdda51a69b52a8797 100644 (file)
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -2744,6 +2744,9 @@ If you have <strong>already bought the licenses for the listed apps</strong>, th
                <item name="wcf.acp.systemCheck.php.opcache"><![CDATA[OPcache]]></item>
                <item name="wcf.acp.systemCheck.php.opcache.description"><![CDATA[PHP’s OPcache improves request processing performance by caching the preprocessed application code. If OPcache is enabled the management functions <kbd>opcache_reset()</kbd> and <kbd>opcache_invalidate()</kbd> need to be available to be able to reliably reset the cache when the application code is updated.]]></item>
                <item name="wcf.acp.systemCheck.php.opcache.broken"><![CDATA[Broken – the management functions are unavailable]]></item>
+               <item name="wcf.acp.systemCheck.web"><![CDATA[Web Server]]></item>
+               <item name="wcf.acp.systemCheck.web.https"><![CDATA[Access via HTTPS/TLS]]></item>
+               <item name="wcf.acp.systemCheck.web.https.description"><![CDATA[New functions in web browsers are only supported when accessed via HTTPS/TLS; important features are missing for unencrypted connections.]]></item>
        </category>
        <category name="wcf.acp.updateServer">
                <item name="wcf.acp.updateServer.add"><![CDATA[Add Server]]></item>