From f1d40873170179d9bef14cc8cf352b2778f1d4b7 Mon Sep 17 00:00:00 2001 From: Brady Wetherington Date: Mon, 7 Feb 2022 11:26:54 -0800 Subject: [PATCH] Fix "secure hostnames" feature for subdirectory-based Snipe-IT installs --- app/Providers/AppServiceProvider.php | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php index fca306722..bcc03272d 100644 --- a/app/Providers/AppServiceProvider.php +++ b/app/Providers/AppServiceProvider.php @@ -47,9 +47,8 @@ class AppServiceProvider extends ServiceProvider // TODO - isn't it somehow 'gauche' to check the environment directly; shouldn't we be using config() somehow? if ( ! env('APP_ALLOW_INSECURE_HOSTS')) { // unless you set APP_ALLOW_INSECURE_HOSTS, you should PROHIBIT forging domain parts of URL via Host: headers $url_parts = parse_url(config('app.url')); - if ($url_parts && array_key_exists('scheme', $url_parts) && array_key_exists('host', $url_parts)) { - $root_url = $url_parts['scheme'].'://'.$url_parts['host'].(isset($url_parts['port']) ? ':'.$url_parts['port'] : ''); - \URL::forceRootUrl($root_url); + if ($url_parts && array_key_exists('scheme', $url_parts) && array_key_exists('host', $url_parts)) { // check for the *required* parts of a bare-minimum URL + \URL::forceRootUrl(config('app.url')); } else { \Log::error("Your APP_URL in your .env is misconfigured - it is: ".config('app.url').". Many things will work strangely unless you fix it."); }