From 0dcc799d8fac2997d16f91a0ec514a673e30f46b Mon Sep 17 00:00:00 2001
From: Laurent David <lmedavid@gmail.com>
Date: Wed, 12 Oct 2022 20:05:46 +0200
Subject: [PATCH] MDL-74468 mod_bigbluebuttonbn: Remove getallheader

* getallheader is only fully compatible with Apache servers. Replace it
with a polyfill.
---
 mod/bigbluebuttonbn/classes/broker.php | 35 ++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 5 deletions(-)

diff --git a/mod/bigbluebuttonbn/classes/broker.php b/mod/bigbluebuttonbn/classes/broker.php
index 1ad97dc80dc..3c48634df31 100644
--- a/mod/bigbluebuttonbn/classes/broker.php
+++ b/mod/bigbluebuttonbn/classes/broker.php
@@ -136,17 +136,15 @@ class broker {
      */
     public static function process_meeting_events(instance $instance) {
         try {
-            // Get the HTTP headers (getallheaders is a PHP function that may only work with Apache).
-            $headers = getallheaders();
+            // Get the HTTP headers.
+            $authorization = self::get_authorization_token();
 
             // Pull the Bearer from the headers.
-            if (!array_key_exists('Authorization', $headers)) {
+            if (empty($authorization)) {
                 $msg = 'Authorization failed';
                 header('HTTP/1.0 400 Bad Request. ' . $msg);
                 return;
             }
-            $authorization = explode(" ", $headers['Authorization']);
-
             // Verify the authenticity of the request.
             $token = \Firebase\JWT\JWT::decode(
                 $authorization[1],
@@ -165,4 +163,31 @@ class broker {
             header('HTTP/1.0 400 Bad Request. ' . $msg);
         }
     }
+
+
+    /**
+     * Get authorisation token
+     *
+     * We could use getallheaders but this is only compatible with apache types of servers
+     * some explanations and examples here: https://www.php.net/manual/en/function.getallheaders.php#127190
+     *
+     * @return array|null an array composed of the Authorization token provided in the header.
+     */
+    private static function get_authorization_token(): ?array {
+        $autorization = null;
+        if (isset($_SERVER['Authorization'])) {
+            $autorization = trim($_SERVER["Authorization"]);
+        } else if (isset($_SERVER['HTTP_AUTHORIZATION'])) {
+            $autorization = trim($_SERVER["HTTP_AUTHORIZATION"]);
+        } else if (function_exists('apache_request_headers')) {
+            $requestheaders = apache_request_headers();
+            $requestheaders = array_combine(array_map('ucwords',
+                    array_keys($requestheaders)), array_values($requestheaders));
+
+            if (isset($requestheaders['Authorization'])) {
+                $autorization = trim($requestheaders['Authorization']);
+            }
+        }
+        return empty($autorization) ? null : explode(" ", $autorization);
+    }
 }