|
@@ -1618,6 +1618,10 @@ class Pico
|
|
|
/**
|
|
|
* Returns the base URL of this Pico instance
|
|
|
*
|
|
|
+ * Security Notice: You MUST configure Pico's base URL explicitly when
|
|
|
+ * using the base URL in contexts that are potentially vulnerable to
|
|
|
+ * HTTP Host Header Injection attacks (e.g. when generating emails).
|
|
|
+ *
|
|
|
* @return string the base url
|
|
|
*/
|
|
|
public function getBaseUrl()
|
|
@@ -1637,9 +1641,14 @@ class Pico
|
|
|
$protocol = 'https';
|
|
|
}
|
|
|
|
|
|
- $this->config['base_url'] =
|
|
|
- $protocol . "://" . $_SERVER['HTTP_HOST']
|
|
|
- . rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\') . '/';
|
|
|
+ $host = $_SERVER['SERVER_NAME'];
|
|
|
+ if (!empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
|
|
|
+ $host = $_SERVER['HTTP_X_FORWARDED_HOST'];
|
|
|
+ } elseif (!empty($_SERVER['HTTP_HOST'])) {
|
|
|
+ $host = $_SERVER['HTTP_HOST'];
|
|
|
+ }
|
|
|
+
|
|
|
+ $this->config['base_url'] = $protocol . "://" . $host . rtrim(dirname($_SERVER['SCRIPT_NAME']), '/\\') . '/';
|
|
|
|
|
|
return $this->config['base_url'];
|
|
|
}
|
|
@@ -1954,7 +1963,7 @@ class Pico
|
|
|
*/
|
|
|
public function getAbsolutePath($path)
|
|
|
{
|
|
|
- if (strncasecmp(PHP_OS, 'WIN', 3) === 0) {
|
|
|
+ if (DIRECTORY_SEPARATOR === '\\') {
|
|
|
if (preg_match('/^([a-zA-Z]:\\\\|\\\\\\\\)/', $path) !== 1) {
|
|
|
$path = $this->getRootDir() . $path;
|
|
|
}
|