mirrors/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent.git synced 2024-11-26 19:26:59 +03:00
Code Issues Projects Releases Packages Wiki Activity

WebAPI: fix validating wrong header field. Closes #7311.

Browse source 
X-Forwarded-Host is a foreign proxy setting, it isn't the same as
qbt's local setting and thus it makes no sense to verify it.
This commit is contained in:
Chocobo1 2017-08-20 21:46:41 +08:00
parent 173f6fd75d
commit 9ef1e32327
No known key found for this signature in database
GPG key ID: 210D9C873253A68C
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/webui/abstractwebapplication.cpp
View file

@ -420,8 +420,7 @@ bool AbstractWebApplication::isCrossSiteRequest(const Http::Request &request) co
bool AbstractWebApplication::validateHostHeader(const Http::Request &request, const Http::Environment &env, const QStringList &domains) const bool AbstractWebApplication::validateHostHeader(const Http::Request &request, const Http::Environment &env, const QStringList &domains) const
{ {
const QUrl hostHeader = QUrl::fromUserInput( const QUrl hostHeader = QUrl::fromUserInput(request.headers.value(Http::HEADER_HOST));
request.headers.value(Http::HEADER_X_FORWARDED_HOST, request.headers.value(Http::HEADER_HOST)));
// (if present) try matching host header's port with local port // (if present) try matching host header's port with local port
const int requestPort = hostHeader.port(); const int requestPort = hostHeader.port();