7 Commits

Author	SHA1	Message	Date
KodeStar	881533baa5	Harden against host header injection and open redirect ... Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so a spoofed value poisoned the page base href, asset() URLs and redirect targets - loading assets from and redirecting to an attacker-controlled host (CVE-2025-50578). - TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto handling is unchanged. - Trusted proxies are now configurable via the TRUSTED_PROXIES env var (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous private ranges. - Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are served and any other Host header is rejected. Unset keeps the historic behaviour of serving arbitrary hosts, so existing installs are unaffected. Resolves #1451	2026-07-08 14:42:12 +01:00
Shift	d41c4c8d4c	Replace deprecated HEADER_X_FORWARDED_ALL constant	2024-02-16 20:33:33 +00:00
Shift	b1dc4d4a41	Apply Laravel coding style ... Shift automatically applies the Laravel coding style - which uses the PSR-2 coding style as a base with some minor additions. You may customize the adopted coding style by adding a [PHP CS Fixer][1] or [PHP CodeSniffer][2] config to your project root. Feel free to use [Shift's Laravel ruleset][3] to help you get started. For more information on customizing the code style applied by Shift, [watch this short video][4]. [1]: https://github.com/FriendsOfPHP/PHP-CS-Fixer [2]: https://github.com/squizlabs/PHP_CodeSniffer [3]: https://gist.github.com/laravel-shift/cab527923ed2a109dda047b97d53c200 [4]: https://laravelshift.com/videos/shift-code-style	2022-03-19 13:54:32 +00:00
Chris	ac8fe7012b	remove false from routes	2019-06-18 10:51:51 +01:00
KodeStar	dd2ca62eaf	Add private subnets to trusted proxies for reverse proxy use	2019-06-11 11:00:44 +01:00
Kode	6501aacb1b	update to laravel 5.7 and try getting autologin saved	2018-10-14 20:50:32 +01:00
Kode	3e1a7119d9	First commit	2018-01-26 14:35:01 +00:00