From 7554a87afcdbad71d7d8fed40d3fd1765f727fd5 Mon Sep 17 00:00:00 2001
From: Alexander Ebert <ebert@woltlab.com>
Date: Sat, 22 Jun 2024 14:43:04 +0200
Subject: [PATCH] Verify the HTTPS support within the system check

---
 .../files/acp/templates/systemCheck.tpl       | 27 ++++++++++++++++++
 .../lib/acp/page/SystemCheckPage.class.php    | 16 +++++++++++
 .../lib/system/request/RouteHandler.class.php | 28 +++++++++++++++++++
 wcfsetup/install/lang/de.xml                  |  3 ++
 wcfsetup/install/lang/en.xml                  |  3 ++
 5 files changed, 77 insertions(+)

diff --git a/wcfsetup/install/files/acp/templates/systemCheck.tpl b/wcfsetup/install/files/acp/templates/systemCheck.tpl
index 4d7e9bae99..eaab63407c 100644
--- a/wcfsetup/install/files/acp/templates/systemCheck.tpl
+++ b/wcfsetup/install/files/acp/templates/systemCheck.tpl
@@ -13,6 +13,17 @@
 <section class="section">
 	<h2 class="sectionTitle">{lang}wcf.acp.systemCheck.result{/lang}</h2>
 	
+	<dl{if !$results[status][web]} class="formError"{/if}>
+		<dt>{lang}wcf.acp.systemCheck.web{/lang}</dt>
+		<dd>
+			{if $results[status][web]}
+				{@$statusOk} {lang}wcf.acp.systemCheck.pass{/lang}
+			{else}
+				{@$statusInsufficient} {lang}wcf.acp.systemCheck.insufficient{/lang}
+			{/if}
+		</dd>
+	</dl>
+	
 	<dl{if !$results[status][php]} class="formError"{/if}>
 		<dt>{lang}wcf.acp.systemCheck.php{/lang}</dt>
 		<dd>
@@ -51,6 +62,22 @@
 	</dl>
 </section>
 
+<section class="section">
+	<h2 class="sectionTitle">{lang}wcf.acp.systemCheck.web{/lang}</h2>
+	
+	<dl{if !$results[web][https]} class="formError"{/if}>
+		<dt>{lang}wcf.acp.systemCheck.web.https{/lang}</dt>
+		<dd>
+			{if $results[web][https]}
+				{@$statusOk} {lang}wcf.acp.systemCheck.pass{/lang}
+			{else}
+				{@$statusInsufficient} {lang}wcf.acp.systemCheck.notSupported{/lang}
+			{/if}
+			<small>{lang}wcf.acp.systemCheck.web.https.description{/lang}</small>
+		</dd>
+	</dl>
+</section>
+
 <section class="section">
 	<h2 class="sectionTitle">{lang}wcf.acp.systemCheck.php{/lang}</h2>
 	
diff --git a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
index 19278c61bd..450f2b8e0e 100644
--- a/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/SystemCheckPage.class.php
@@ -8,6 +8,7 @@ use wcf\system\database\util\PreparedStatementConditionBuilder;
 use wcf\system\Environment;
 use wcf\system\exception\SystemException;
 use wcf\system\registry\RegistryHandler;
+use wcf\system\request\RouteHandler;
 use wcf\system\WCF;
 use wcf\util\FileUtil;
 
@@ -150,10 +151,14 @@ class SystemCheckPage extends AbstractPage
             ],
             'x64' => false,
         ],
+        'web' => [
+            'https' => false,
+        ],
         'status' => [
             'directories' => false,
             'mysql' => false,
             'php' => false,
+            'web' => false,
         ],
     ];
 
@@ -184,6 +189,7 @@ class SystemCheckPage extends AbstractPage
         $this->validatePhpVersion();
         $this->validatePhpGdSupport();
         $this->validateWritableDirectories();
+        $this->validateWebHttps();
 
         if (
             $this->results['status']['mysql']
@@ -449,4 +455,14 @@ class SystemCheckPage extends AbstractPage
 
         return true;
     }
+
+    /**
+     * @since 6.1
+     */
+    protected function validateWebHttps(): void
+    {
+        $this->results['web']['https'] = RouteHandler::secureContext();
+
+        $this->results['status']['web'] = $this->results['web']['https'];
+    }
 }
diff --git a/wcfsetup/install/files/lib/system/request/RouteHandler.class.php b/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
index f4ba8ce197..adb6c970f3 100644
--- a/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
+++ b/wcfsetup/install/files/lib/system/request/RouteHandler.class.php
@@ -263,6 +263,34 @@ final class RouteHandler extends SingletonFactory
         return self::$secure;
     }
 
+    /**
+     * Returns true if the current environment is treated as a secure context by
+     * browsers.
+     *
+     * @see https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts#when_is_a_context_considered_secure
+     * @since 6.1
+     */
+    public static function secureContext(): bool
+    {
+        static $secureContext = null;
+        if ($secureContext === null) {
+            $secureContext = self::secureConnection();
+
+            // The connection is considered as secure if it is encrypted with
+            // TLS, or if the target host is a local address.
+            if (!$secureContext) {
+                $host = $_SERVER['HTTP_HOST'];
+
+                // @see https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-let-localhost-be-localhost-02
+                if ($host === '127.0.0.1' || $host === 'localhost' || \str_ends_with($host, '.localhost')) {
+                    $secureContext = true;
+                }
+            }
+        }
+
+        return $secureContext;
+    }
+
     /**
      * Returns HTTP protocol, either 'http://' or 'https://'.
      */
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index 14e58e9993..c32ac3c706 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -2815,6 +2815,9 @@ Abschnitte dürfen nicht leer sein und nur folgende Zeichen enthalten: <kbd>[a-z
 		<item name="wcf.acp.systemCheck.php.opcache"><![CDATA[OPcache]]></item>
 		<item name="wcf.acp.systemCheck.php.opcache.description"><![CDATA[PHPs OPcache beschleunigt die Bearbeitung von Anfragen, indem der vorverarbeitete Programmcode gecached wird. Bei aktiviertem OPcache müssen die Verwaltungsfunktionen <kbd>opcache_reset()</kbd> und <kbd>opcache_invalidate()</kbd> zur Verfügung stehen, damit der Cache nach einer Aktualisierung des Programmcodes zuverlässig neu aufgebaut werden kann.]]></item>
 		<item name="wcf.acp.systemCheck.php.opcache.broken"><![CDATA[Fehlerhaft – die Verwaltungsfunktionen sind nicht verfügbar]]></item>
+		<item name="wcf.acp.systemCheck.web"><![CDATA[Webserver]]></item>
+		<item name="wcf.acp.systemCheck.web.https"><![CDATA[Aufruf per HTTPS/TLS]]></item>
+		<item name="wcf.acp.systemCheck.web.https.description"><![CDATA[Neue Funktionen in Webbrowsern werden nur beim Aufruf über HTTPS/TLS unterstützt, bei unverschlüsselten Verbindungen fehlen wichtige Funktionen.]]></item>
 	</category>
 	<category name="wcf.acp.updateServer">
 		<item name="wcf.acp.updateServer.add"><![CDATA[Server hinzufügen]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index 1e3c827129..220bf41552 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -2744,6 +2744,9 @@ If you have <strong>already bought the licenses for the listed apps</strong>, th
 		<item name="wcf.acp.systemCheck.php.opcache"><![CDATA[OPcache]]></item>
 		<item name="wcf.acp.systemCheck.php.opcache.description"><![CDATA[PHP’s OPcache improves request processing performance by caching the preprocessed application code. If OPcache is enabled the management functions <kbd>opcache_reset()</kbd> and <kbd>opcache_invalidate()</kbd> need to be available to be able to reliably reset the cache when the application code is updated.]]></item>
 		<item name="wcf.acp.systemCheck.php.opcache.broken"><![CDATA[Broken – the management functions are unavailable]]></item>
+		<item name="wcf.acp.systemCheck.web"><![CDATA[Web Server]]></item>
+		<item name="wcf.acp.systemCheck.web.https"><![CDATA[Access via HTTPS/TLS]]></item>
+		<item name="wcf.acp.systemCheck.web.https.description"><![CDATA[New functions in web browsers are only supported when accessed via HTTPS/TLS; important features are missing for unencrypted connections.]]></item>
 	</category>
 	<category name="wcf.acp.updateServer">
 		<item name="wcf.acp.updateServer.add"><![CDATA[Add Server]]></item>
-- 
2.20.1