d4708/qBittorrent
1
0
Fork 0
mirror of https://github.com/d47081/qBittorrent.git synced 2025-01-11 07:18:08 +00:00
Code Issues Projects Releases Wiki Activity

WebAPI: fix validating wrong header field. Closes #7311.

Browse Source 
X-Forwarded-Host is a foreign proxy setting, it isn't the same as
qbt's local setting and thus it makes no sense to verify it.
This commit is contained in:
Chocobo1 2017-08-20 21:46:41 +08:00
parent 173f6fd75d
commit 9ef1e32327
No known key found for this signature in database
GPG Key ID: 210D9C873253A68C
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/webui/abstractwebapplication.cpp
View File

@ -420,8 +420,7 @@ bool AbstractWebApplication::isCrossSiteRequest(const Http::Request &request) co
bool AbstractWebApplication::validateHostHeader(const Http::Request &request, const Http::Environment &env, const QStringList &domains) const bool AbstractWebApplication::validateHostHeader(const Http::Request &request, const Http::Environment &env, const QStringList &domains) const
{ {
const QUrl hostHeader = QUrl::fromUserInput( const QUrl hostHeader = QUrl::fromUserInput(request.headers.value(Http::HEADER_HOST));
request.headers.value(Http::HEADER_X_FORWARDED_HOST, request.headers.value(Http::HEADER_HOST)));
// (if present) try matching host header's port with local port // (if present) try matching host header's port with local port
const int requestPort = hostHeader.port(); const int requestPort = hostHeader.port();