r89621 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:< r89620‎ | r89621 | r89622 >
Date:03:31, 7 June 2011
Author:tstarling
Status:ok
Tags:
Comment:
When detecting $wgServer, do not fall back to $_SERVER['HTTP_HOST']. It's unlikely that this is used by anything, since SERVER_NAME takes precedence, and SERVER_NAME is required by CGI 1.1 and appears to always be set by the major web servers. If it were ever used, it would open up a cache-poisoning vulnerability. Partially reverts r8010.
Modified paths:
  • /trunk/phase3/includes/DefaultSettings.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/DefaultSettings.php
——@@ -63,8 +63,6 @@
6464 $serverName = $_SERVER['SERVER_NAME'];
6565 } elseif( isset( $_SERVER['HOSTNAME'] ) ) {
6666 $serverName = $_SERVER['HOSTNAME'];
67 -} elseif( isset( $_SERVER['HTTP_HOST'] ) ) {
68 - $serverName = $_SERVER['HTTP_HOST'];
6967 } elseif( isset( $_SERVER['SERVER_ADDR'] ) ) {
7068 $serverName = $_SERVER['SERVER_ADDR'];
7169 } else {

Past revisions this follows-up on

RevisionCommit summaryAuthorDate
r8010more stuff to fall back onavar12:11, 31 March 2005

Status & tagging log