e1d4b4682e
- Fix circular cache dependency in TrustHosts where handle() checked cache before hosts() could populate it, causing host validation to never activate - Validate both Host and X-Forwarded-Host headers against trusted hosts list (X-Forwarded-Host is checked before TrustProxies applies it to the request) - Use base_url() instead of url() for password reset link generation so the URL is derived from server-side config (FQDN / public IP) instead of the request context - Strip port from X-Forwarded-Host before matching (e.g. host:443 → host) - Add tests for host validation, cache population, and reset URL generation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ApiAbility.php | ||
| ApiAllowed.php | ||
| ApiSensitiveData.php | ||
| Authenticate.php | ||
| CanAccessTerminal.php | ||
| CanCreateResources.php | ||
| CanUpdateResource.php | ||
| CheckForcePasswordReset.php | ||
| DecideWhatToDoWithUser.php | ||
| EncryptCookies.php | ||
| PreventRequestsDuringMaintenance.php | ||
| RedirectIfAuthenticated.php | ||
| TrimStrings.php | ||
| TrustHosts.php | ||
| TrustProxies.php | ||
| ValidateSignature.php | ||
| VerifyCsrfToken.php | ||