comparison vendor/zendframework/zend-diactoros/src/ServerRequestFactory.php @ 13:5fb285c0d0e3

Update Drupal core to 8.4.7 via Composer. Security update; I *think* we've
been lucky to get away with this so far, as we don't support self-registration
which seems to be used by the so-called "drupalgeddon 2" attack that 8.4.5
was vulnerable to.

         if (($https && 'off' !== $https)
             || self::getHeader('x-forwarded-proto', $headers, false) === 'https'
         ) {
             $scheme = 'https';
         }
-        if (! empty($scheme)) {
-            $uri = $uri->withScheme($scheme);
-        }
+        $uri = $uri->withScheme($scheme);
 
         // Set the host
         $accumulator = (object) ['host' => '', 'port' => null];
         self::marshalHostAndPortFromHeaders($accumulator, $server, $headers);
         $host = $accumulator->host;