|
| Reporter | jbert | Assigned To | jreese | |
|---|
| Priority | normal | Severity | tweak | Reproducibility | always |
|---|
| Status | closed | Resolution | fixed | |
|---|
| Product Version | 1.1.2 | |
|---|
| Fixed in Version | 1.1.4 | |
|---|
|
| Summary | 0009693: Generated HTML contains multiple hostnames when proxied |
|---|
| Description | When Mantis is hosted on a webserver which is accessed through a chain of proxies, the generated HTML code contains multiple hostnames when linking to the CSS stylesheet, images, ...
A snippet of the generated HTML code for the stylesheet:
<link rel="stylesheet" type="text/css" href="http://mantistest2.domain.local, mantistest.domain.local, mantis.domain.local/css/default.css" /> |
|---|
| Steps To Reproduce | -Set up two proxies and a webserver. Proxy A forwards to B, and proxy B forwards replies to the webserver hosting mantis.
-Go to proxy A and browse to mantis.
-The site will display, but no images are shown and there is no styling other than the issues being coloured. |
|---|
| Additional Information | The problem lies in config_defaults_inc.php: when $t_host is set using the "HTTP_X_FORWARDED_HOST" server variable, the code does not take in account that this variable can be a list.
The format of this variable is specified in the Apache docs when the "X-Forwarded-Host" header is discussed ( http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#x-headers ). |
|---|
| Tags | patch |
|---|
| Attached Files |
multiple_proxies.patch (727 bytes)
Index: config_defaults_inc.php
===================================================================
--- config_defaults_inc.php (revision 5670)
+++ config_defaults_inc.php (working copy)
@@ -85,7 +85,12 @@
}
if ( isset( $_SERVER['HTTP_X_FORWARDED_HOST'] ) ) { // Support ProxyPass
- $t_host = $_SERVER['HTTP_X_FORWARDED_HOST'];
+ $host_delim = strpos( $_SERVER['HTTP_X_FORWARDED_HOST'], "," );
+ if( $host_delim === false ) {
+ $t_host = $_SERVER['HTTP_X_FORWARDED_HOST'];
+ } else {
+ $t_host = substr( $_SERVER['HTTP_X_FORWARDED_HOST'], 0, $host_delim);
+ }
} else if ( isset( $_SERVER['HTTP_HOST'] ) ) {
$t_host = $_SERVER['HTTP_HOST'];
} else if ( isset( $_SERVER['SERVER_NAME'] ) ) {
|
|---|
|
