Merge pull request #6889 from coollabsio/andrasbacsai/fix-host-header-injection

feat: implement TrustHosts middleware to handle FQDN and IP address trust logic

app/Http/Kernel.php

@@ -14,7 +14,7 @@ class Kernel extends HttpKernel
      * @var array<int, class-string|string>
      */
     protected $middleware = [
-        // \App\Http\Middleware\TrustHosts::class,
+        \App\Http\Middleware\TrustHosts::class,
         \App\Http\Middleware\TrustProxies::class,
         \Illuminate\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\PreventRequestsDuringMaintenance::class,

app/Http/Middleware/TrustHosts.php

@@ -2,7 +2,10 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\InstanceSettings;
 use Illuminate\Http\Middleware\TrustHosts as Middleware;
+use Illuminate\Support\Facades\Cache;
+use Spatie\Url\Url;
 
 class TrustHosts extends Middleware
 {
@@ -13,8 +16,37 @@ class TrustHosts extends Middleware
      */
     public function hosts(): array
     {
-        return [
-            $this->allSubdomainsOfApplicationUrl(),
-        ];
+        $trustedHosts = [];
+
+        // Trust the configured FQDN from InstanceSettings (cached to avoid DB query on every request)
+        // Use empty string as sentinel value instead of null so negative results are cached
+        $fqdnHost = Cache::remember('instance_settings_fqdn_host', 300, function () {
+            try {
+                $settings = InstanceSettings::get();
+                if ($settings && $settings->fqdn) {
+                    $url = Url::fromString($settings->fqdn);
+                    $host = $url->getHost();
+
+                    return $host ?: '';
+                }
+            } catch (\Exception $e) {
+                // If instance settings table doesn't exist yet (during installation),
+                // return empty string (sentinel) so this result is cached
+            }
+
+            return '';
+        });
+
+        // Convert sentinel value back to null for consumption
+        $fqdnHost = $fqdnHost !== '' ? $fqdnHost : null;
+
+        if ($fqdnHost) {
+            $trustedHosts[] = $fqdnHost;
+        }
+
+        // Trust all subdomains of APP_URL as fallback
+        $trustedHosts[] = $this->allSubdomainsOfApplicationUrl();
+
+        return array_filter($trustedHosts);
     }
 }

app/Models/InstanceSettings.php

@@ -35,13 +35,18 @@ class InstanceSettings extends Model
     protected static function booted(): void
     {
         static::updated(function ($settings) {
-            if ($settings->isDirty('helper_version')) {
+            if ($settings->wasChanged('helper_version')) {
                 Server::chunkById(100, function ($servers) {
                     foreach ($servers as $server) {
                         PullHelperImageJob::dispatch($server);
                     }
                 });
             }
+
+            // Clear trusted hosts cache when FQDN changes
+            if ($settings->wasChanged('fqdn')) {
+                \Cache::forget('instance_settings_fqdn_host');
+            }
         });
     }