From 778a4e5fa8eb3f08300683e928af07320891a239 Mon Sep 17 00:00:00 2001
From: maxpozdeev <maxpozdeev@gmail.com>
Date: Sun, 6 Aug 2023 17:05:25 +0300
Subject: [PATCH] * check X-Forwarded-Proto for https

---
 src/init.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/init.php b/src/init.php
index b22fdfb..81971eb 100644
--- a/src/init.php
+++ b/src/init.php
@@ -376,12 +376,13 @@ function is_https(): bool
     if (isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on') {
         return true;
     }
-    /*
-     TODO: Check for X-Forwarded-Proto==https or X-Forwarded-For==https ?
-     */
     if (defined('MTT_USE_HTTPS') && MTT_USE_HTTPS) {
         return true;
     }
+    // This HTTP header can be overriden by user agent!
+    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) == 'https') {
+        return true;
+    }
     return false;
 }