Sanitise hostname

inex · Jan 31, 2018 · 4084627 · 4084627
1 parent 69a8136
commit 4084627
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/library/OSS/Utils.php b/library/OSS/Utils.php
@@ -219,9 +219,14 @@ public static function genUrl( $controller = false, $action = false, $module = f
                     case 'HTTP_X_FORWARDED_HOST':
                         $host = $_SERVER['HTTP_X_FORWARDED_HOST'];
                         break;
-                        
+
                     case 'REPLACE':
-                        $host = $options['utils']['genurl']['host_replace'];
+                        // need to make sure the host is an actual host
+                        if( preg_match( "/^(http[s]{0,1}:\/\/[a-zA-Z0-9\-_\.]+)[\/]{0,1}.*/", $options['utils']['genurl']['host_replace'], $host_array ) ) {
+                            $host = $host_array[1];
+                        } else {
+                            $host = $options['utils']['genurl']['host_replace'];
+                        }
                         break;
 
                     default: