8 Commits

Author	SHA1	Message	Date
KodeStar	881533baa5	Harden against host header injection and open redirect ... Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so a spoofed value poisoned the page base href, asset() URLs and redirect targets - loading assets from and redirecting to an attacker-controlled host (CVE-2025-50578). - TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto handling is unchanged. - Trusted proxies are now configurable via the TRUSTED_PROXIES env var (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous private ranges. - Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are served and any other Host header is rejected. Unset keeps the historic behaviour of serving arbitrary hosts, so existing installs are unaffected. Resolves #1451	2026-07-08 14:42:12 +01:00
Chris Hunt	8fb6438254	Updates to vendors etc	2025-07-11 15:57:48 +01:00
Shift	f5ddd93141	Re-register routes	2025-07-10 18:54:03 +00:00
Shift	8554861d0a	Re-register service providers	2025-07-10 18:54:02 +00:00
Shift	42d29f0fdb	Re-register HTTP middleware	2025-07-10 18:54:02 +00:00
Shift	474059eee8	Default new bootstrap/app.php	2025-07-10 18:54:01 +00:00
Kode	51ddaccc16	Update defaults	2022-03-19 15:04:26 +00:00
Kode	3e1a7119d9	First commit	2018-01-26 14:35:01 +00:00