KodeStar 881533baa5 Harden against host header injection and open redirect ...

Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so
a spoofed value poisoned the page base href, asset() URLs and redirect
targets - loading assets from and redirecting to an attacker-controlled host
(CVE-2025-50578).

- TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer
  influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto
  handling is unchanged.
- Trusted proxies are now configurable via the TRUSTED_PROXIES env var
  (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous
  private ranges.
- Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are
  served and any other Host header is rejected. Unset keeps the historic
  behaviour of serving arbitrary hosts, so existing installs are unaffected.

Resolves #1451

2026-07-08 14:42:12 +01:00

..

Feature

Harden against host header injection and open redirect

2026-07-08 14:42:12 +01:00

Unit

Fix languages

2024-02-17 15:13:43 +00:00

.env.testing

Set new ENV variables

2025-07-10 18:54:01 +00:00

TestCase.php

Remove createApplication method

2025-07-10 18:54:07 +00:00