mirror of
https://github.com/linuxserver/Heimdall.git
synced 2026-08-07 07:16:13 +00:00
KodeStar
881533baa5
Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so a spoofed value poisoned the page base href, asset() URLs and redirect targets - loading assets from and redirecting to an attacker-controlled host (CVE-2025-50578). - TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto handling is unchanged. - Trusted proxies are now configurable via the TRUSTED_PROXIES env var (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous private ranges. - Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are served and any other Host header is rejected. Unset keeps the historic behaviour of serving arbitrary hosts, so existing installs are unaffected. Resolves #1451
79 lines
1.9 KiB
Bash
79 lines
1.9 KiB
Bash
APP_NAME=Heimdall
|
|
APP_ENV=local
|
|
APP_KEY=
|
|
APP_DEBUG=false
|
|
APP_URL=http://localhost
|
|
|
|
# Security: Host Header Injection / Open Redirect hardening (CVE-2025-50578).
|
|
# TRUSTED_PROXIES: comma-separated CIDRs/IPs of reverse proxies allowed to set
|
|
# X-Forwarded-* headers. Defaults to the private ranges below when unset. Use
|
|
# "*" to trust all proxies (only behind a trusted network boundary).
|
|
#TRUSTED_PROXIES=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8,127.0.0.1
|
|
# TRUSTED_HOSTS: comma-separated hostnames Heimdall is allowed to serve. Unset
|
|
# means no restriction (default, backward compatible). Set this to your own
|
|
# domain to fully prevent host-header injection / open redirects.
|
|
#TRUSTED_HOSTS=heimdall.example.com
|
|
|
|
APP_LOCALE=en
|
|
APP_FALLBACK_LOCALE=en
|
|
APP_FAKER_LOCALE=en_US
|
|
APP_MAINTENANCE_DRIVER=file
|
|
APP_MAINTENANCE_STORE=database
|
|
BCRYPT_ROUNDS=12
|
|
|
|
LOG_CHANNEL=daily
|
|
LOG_STACK=single
|
|
|
|
DB_CONNECTION=sqlite
|
|
DB_DATABASE=app.sqlite
|
|
|
|
#DB_CONNECTION=<mysql | pgsql>
|
|
#DB_HOST=<hostname | ip>
|
|
#DB_PORT=<port number>
|
|
#DB_DATABASE=<database>
|
|
#DB_USERNAME=<user>
|
|
#DB_PASSWORD=<password>
|
|
|
|
BROADCAST_CONNECTION=log
|
|
CACHE_STORE=file
|
|
QUEUE_CONNECTION=sync
|
|
SESSION_DRIVER=file
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
QUEUE_DRIVER=sync
|
|
|
|
REDIS_HOST=127.0.0.1
|
|
REDIS_PASSWORD=null
|
|
REDIS_PORT=6379
|
|
|
|
MAIL_MAILER=smtp
|
|
MAIL_HOST=smtp.mailtrap.io
|
|
MAIL_PORT=2525
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_ENCRYPTION=null
|
|
MAIL_FROM_ADDRESS=null
|
|
MAIL_FROM_NAME="${APP_NAME}"
|
|
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
AWS_DEFAULT_REGION=us-east-1
|
|
AWS_BUCKET=
|
|
|
|
PUSHER_APP_ID=
|
|
PUSHER_APP_KEY=
|
|
PUSHER_APP_SECRET=
|
|
PUSHER_APP_CLUSTER=mt1
|
|
|
|
MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
|
|
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
|
|
|
|
AUTH_ROLES_ENABLE=false
|
|
AUTH_ROLES_HEADER="remote-groups"
|
|
AUTH_ROLES_HTTP_HEADER="HTTP_REMOTE_GROUPS"
|
|
AUTH_ROLES_ADMIN="admin"
|
|
AUTH_ROLES_DELIMITER=","
|
|
|
|
ALLOW_INTERNAL_REQUESTS=false |