From 8e80aa48915688be804305e90bf9cff9f8b88346 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Tim=20D=C3=BCsterhus?= <duesterhus@woltlab.com>
Date: Fri, 5 Mar 2021 16:48:05 +0100
Subject: [PATCH] Add INTERNAL_HOSTNAMES option

Resolves #4049
---
 com.woltlab.wcf/option.xml                    | 22 ++++++++------
 constants.php                                 |  1 +
 .../application/ApplicationHandler.class.php  | 29 +++++++++----------
 wcfsetup/install/lang/de.xml                  |  2 ++
 wcfsetup/install/lang/en.xml                  |  2 ++
 5 files changed, 31 insertions(+), 25 deletions(-)

diff --git a/com.woltlab.wcf/option.xml b/com.woltlab.wcf/option.xml
index 82d256404e..f0fcb294af 100644
--- a/com.woltlab.wcf/option.xml
+++ b/com.woltlab.wcf/option.xml
@@ -488,6 +488,10 @@
 				<optiontype>boolean</optiontype>
 				<defaultvalue>1</defaultvalue>
 			</option>
+			<option name="internal_hostnames">
+				<categoryname>general.page</categoryname>
+				<optiontype>textarea</optiontype>
+			</option>
 			<option name="head_code">
 				<categoryname>general.page</categoryname>
 				<optiontype>textarea</optiontype>
@@ -1691,14 +1695,14 @@ DESC:wcf.global.sortOrder.descending</selectoptions>
 		</options>
 	</import>
 	<delete>
-		<option name="http_enable_gzip" />
-		<option name="meta_keywords" />
-		<option name="register_admin_notification" />
-		<option name="session_timeout" />
-		<option name="session_validate_ip_address" />
-		<option name="session_validate_user_agent" />
-		<option name="session_enable_virtualization" />
-		<option name="blacklist_hostnames" />
-		<option name="module_user_cover_photo" />
+		<option name="http_enable_gzip"/>
+		<option name="meta_keywords"/>
+		<option name="register_admin_notification"/>
+		<option name="session_timeout"/>
+		<option name="session_validate_ip_address"/>
+		<option name="session_validate_user_agent"/>
+		<option name="session_enable_virtualization"/>
+		<option name="blacklist_hostnames"/>
+		<option name="module_user_cover_photo"/>
 	</delete>
 </data>
diff --git a/constants.php b/constants.php
index 7cd5e166f1..407d5a855c 100644
--- a/constants.php
+++ b/constants.php
@@ -253,3 +253,4 @@
 \define('ENABLE_ENTERPRISE_MODE', 0);
 \define('MESSAGE_ENABLE_USER_CONSENT', 1);
 \define('MODIFICATION_LOG_EXPIRATION', 0);
+\define('INTERNAL_HOSTNAMES', '');
diff --git a/wcfsetup/install/files/lib/system/application/ApplicationHandler.class.php b/wcfsetup/install/files/lib/system/application/ApplicationHandler.class.php
index 8d8e2f12e3..9edd53986c 100644
--- a/wcfsetup/install/files/lib/system/application/ApplicationHandler.class.php
+++ b/wcfsetup/install/files/lib/system/application/ApplicationHandler.class.php
@@ -8,12 +8,14 @@ use wcf\data\application\ApplicationList;
 use wcf\data\package\Package;
 use wcf\data\package\PackageList;
 use wcf\system\cache\builder\ApplicationCacheBuilder;
-use wcf\system\Regex;
 use wcf\system\request\RequestHandler;
 use wcf\system\request\RouteHandler;
 use wcf\system\SingletonFactory;
 use wcf\system\WCF;
+use wcf\util\ArrayUtil;
 use wcf\util\FileUtil;
+use wcf\util\StringUtil;
+use wcf\util\Url;
 
 /**
  * Handles multi-application environments.
@@ -207,30 +209,25 @@ class ApplicationHandler extends SingletonFactory
      */
     public function isInternalURL($url)
     {
-        $protocolRegex = new Regex('^https(?=://)');
         if (empty($this->pageURLs)) {
             foreach ($this->getApplications() as $application) {
-                $this->pageURLs[] = \preg_replace(
-                    '~/$~',
-                    '',
-                    $protocolRegex->replace(RouteHandler::getProtocol() . $application->domainName, 'http')
-                );
+                $this->pageURLs[] = $application->domainName;
             }
-            $this->pageURLs = \array_unique($this->pageURLs);
-        }
 
-        foreach ($this->pageURLs as $pageURL) {
-            if (\stripos($protocolRegex->replace($url, 'http'), $pageURL) === 0) {
-                return true;
-            }
+            $this->pageURLs = \array_unique(\array_merge(
+                $this->pageURLs,
+                ArrayUtil::trim(\explode("\n", StringUtil::unifyNewlines(\INTERNAL_HOSTNAMES)))
+            ));
         }
 
-        // relative urls contain no protocol, including implied
-        if (!\preg_match('~^([a-zA-Z0-9]+)?://~', $url)) {
+        $host = Url::parse($url)['host'];
+
+        // Relative URLs are internal.
+        if (!$host) {
             return true;
         }
 
-        return false;
+        return Url::getHostnameMatcher($this->pageURLs)($host);
     }
 
     /**
diff --git a/wcfsetup/install/lang/de.xml b/wcfsetup/install/lang/de.xml
index c85cb570b3..3c003102f9 100644
--- a/wcfsetup/install/lang/de.xml
+++ b/wcfsetup/install/lang/de.xml
@@ -1783,6 +1783,8 @@ Die Datenbestände werden sorgfältig gepflegt, aber es ist nicht ausgeschlossen
 		<item name="wcf.acp.option.message_enable_user_consent"><![CDATA[Inhalte von externen Anbietern erst nach Zustimmung anzeigen]]></item>
 		<item name="wcf.acp.option.modification_log_expiration"><![CDATA[Speicherzeit für Änderungen]]></item>
 		<item name="wcf.acp.option.modification_log_expiration.description"><![CDATA[Zeitraum, nachdem alte Änderungen aus dem Änderungsprotokoll entfernt werden [0, um die Entfernung gänzlich zu deaktivieren]]]></item>
+		<item name="wcf.acp.option.internal_hostnames"><![CDATA[Zusätzliche interne Domains]]></item>
+		<item name="wcf.acp.option.internal_hostnames.description"><![CDATA[Die aufgeführten Domains werden, neben den Domains der installierten Apps, als interne Domains angesehen. Der Abgleich erfolgt auf Basis der strikten Übereinstimmung, optional können Subdomains mit einem Platzhalter berücksichtigt werden: <kbd>*.example.com</kbd> umfasst sowohl <kbd>example.com</kbd> als auch Subdomains wie <kbd>foo.example.com</kbd> oder <kbd>www.example.com</kbd>.<br>Bitte nur eine Domain pro Zeile eingeben.]]></item>
 	</category>
 	<category name="wcf.acp.customOption">
 		<item name="wcf.acp.customOption.list"><![CDATA[Eingabefelder]]></item>
diff --git a/wcfsetup/install/lang/en.xml b/wcfsetup/install/lang/en.xml
index f64a148e0f..fb8915cd72 100644
--- a/wcfsetup/install/lang/en.xml
+++ b/wcfsetup/install/lang/en.xml
@@ -1767,6 +1767,8 @@ The database is carefully maintained, but there will be always be a margin of er
 		<item name="wcf.acp.option.message_enable_user_consent"><![CDATA[Prompt users before displaying content from external sources]]></item>
 		<item name="wcf.acp.option.modification_log_expiration"><![CDATA[Storage Time for Modification Logs]]></item>
 		<item name="wcf.acp.option.modification_log_expiration.description"><![CDATA[Modification logs will be deleted after the entered amount of days. To disable deleting old modification logs, enter “0”.]]></item>
+		<item name="wcf.acp.option.internal_hostnames"><![CDATA[Additional Internal Domains]]></item>
+		<item name="wcf.acp.option.internal_hostnames.description"><![CDATA[The listed domains will be considered as internal domains in addition to the domains in use by installed apps. Hostnames are exact matches only, a leading wildcard can be used to exclude an entire domain: <kbd>*.example.com</kbd> matches <kbd>example.com</kbd> and subdomains such as <kbd>foo.example.com</kbd> or <kbd>www.example.com</kbd>.<br>Enter one domain per line only.]]></item>
 	</category>
 	<category name="wcf.acp.customOption">
 		<item name="wcf.acp.customOption.list"><![CDATA[Option Fields]]></item>
-- 
2.20.1