From 623ef322e44e1d73affbc122655cb956beb4d7ba Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 21 Dec 2016 20:45:02 +0100 Subject: [PATCH] Add support for port != 80 --- php/auth.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/php/auth.php b/php/auth.php index 1c8a4fe2..7972480b 100644 --- a/php/auth.php +++ b/php/auth.php @@ -33,8 +33,16 @@ function check_cors() { // Since the Host header is easily manipulated, we can only check if it's wrong and can't use it // to validate that the client is authorized, only unauthorized. - if(isset($_SERVER['HTTP_HOST']) && !in_array("http://".$_SERVER['HTTP_HOST'], $AUTHORIZED_HOSTNAMES)) { - log_and_die("Failed Host Check: " . $_SERVER['HTTP_HOST'] .' vs '. join(', ', $AUTHORIZED_HOSTNAMES)); + $server_host = $_SERVER['HTTP_HOST']; + + // If HTTP_HOST contains a non-standard port (!= 80) we have to strip the port + if(strpos($server_host,":")) + { + $server_host = parse_url($_SERVER['HTTP_HOST'], PHP_URL_HOST); + } + + if(isset($_SERVER['HTTP_HOST']) && !in_array("http://".$server_host, $AUTHORIZED_HOSTNAMES)) { + log_and_die("Failed Host Check: " . $server_host .' vs '. join(', ', $AUTHORIZED_HOSTNAMES)); } if(isset($_SERVER['HTTP_ORIGIN'])) {