[serendipity-cvs] [s9y/Serendipity] 20acbc: Fix possible mail header injection attack by not u...

onli via php-blog-cvs <[email protected]> Wed, 08 Apr 2026 01:37:01 -0700

Newsgroups	gmane.comp.serendipity.cvs
Message-ID	<s9y/Serendipity/push/refs/heads/master/[email protected]>

  Branch: refs/heads/master
  Home:   https://github.com/s9y/Serendipity
  Commit: 20acbc2ff1c179eeaf60463e22634dde2d689ee7
      https://github.com/s9y/Serendipity/commit/20acbc2ff1c179eeaf60463e22634dde2d689ee7
  Author: onli <[email protected]>
  Date:   2026-04-08 (Wed, 08 Apr 2026)

  Changed paths:
    M docs/NEWS
    M include/functions.inc.php

  Log Message:
  -----------
  Fix possible mail header injection attack by not using HTTP_HOST (#959)

* Fix possible mail header injection attack by not using HTTP_HOST
Rely on the configured $serendipity['baseURL'] instead, with additional safeguards for the baseURL autodection mode

* document changes



To unsubscribe from these emails, change your notification settings at https://github.com/s9y/Serendipity/settings/notifications