e1d4b4682e
- Fix circular cache dependency in TrustHosts where handle() checked cache before hosts() could populate it, causing host validation to never activate - Validate both Host and X-Forwarded-Host headers against trusted hosts list (X-Forwarded-Host is checked before TrustProxies applies it to the request) - Use base_url() instead of url() for password reset link generation so the URL is derived from server-side config (FQDN / public IP) instead of the request context - Strip port from X-Forwarded-Host before matching (e.g. host:443 → host) - Add tests for host validation, cache population, and reset URL generation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Application | ||
| Channels | ||
| Container | ||
| Database | ||
| Dto | ||
| Internal | ||
| ScheduledTask | ||
| Server | ||
| TransactionalEmails | ||
| CustomEmailNotification.php | ||
| Notification.php | ||
| SslExpirationNotification.php | ||
| Test.php | ||