mirror of
https://github.com/linuxserver/Heimdall.git
synced 2026-08-07 07:16:13 +00:00
KodeStar
881533baa5
Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so a spoofed value poisoned the page base href, asset() URLs and redirect targets - loading assets from and redirecting to an attacker-controlled host (CVE-2025-50578). - TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto handling is unchanged. - Trusted proxies are now configurable via the TRUSTED_PROXIES env var (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous private ranges. - Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are served and any other Host header is rejected. Unset keeps the historic behaviour of serving arbitrary hosts, so existing installs are unaffected. Resolves #1451
47 lines
1.6 KiB
PHP
47 lines
1.6 KiB
PHP
<?php
|
|
|
|
use Illuminate\Foundation\Application;
|
|
use Illuminate\Foundation\Configuration\Exceptions;
|
|
use Illuminate\Foundation\Configuration\Middleware;
|
|
|
|
return Application::configure(basePath: dirname(__DIR__))
|
|
->withProviders([
|
|
\Spatie\Html\HtmlServiceProvider::class,
|
|
])
|
|
->withRouting(
|
|
web: __DIR__.'/../routes/web.php',
|
|
api: __DIR__.'/../routes/api.php',
|
|
commands: __DIR__.'/../routes/console.php',
|
|
channels: __DIR__.'/../routes/channels.php',
|
|
health: '/up',
|
|
)
|
|
->withMiddleware(function (Middleware $middleware) {
|
|
$middleware->redirectGuestsTo(fn () => route('login'));
|
|
|
|
$middleware->validateCsrfTokens(except: [
|
|
//
|
|
'order',
|
|
'appload',
|
|
'test_config',
|
|
//'get_stats'
|
|
]);
|
|
|
|
$middleware->append(\Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class);
|
|
|
|
$middleware->throttleApi('60,1');
|
|
|
|
$middleware->replace(\Illuminate\Http\Middleware\TrustProxies::class, \App\Http\Middleware\TrustProxies::class);
|
|
|
|
$middleware->trustHosts();
|
|
$middleware->replace(\Illuminate\Http\Middleware\TrustHosts::class, \App\Http\Middleware\TrustHosts::class);
|
|
|
|
$middleware->alias([
|
|
'allowed' => \App\Http\Middleware\CheckAllowed::class,
|
|
'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
|
|
'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
|
|
]);
|
|
})
|
|
->withExceptions(function (Exceptions $exceptions) {
|
|
//
|
|
})->create();
|