adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

X-Forwarded-Host header with a comma-separated list should be supported #1470

New Issue
Open
opened 2026-10-05 00:45:12 +02:00 by adam · 0 comments
adam commented 2026-10-05 00:45:12 +02:00
Owner
Copy link
Copy source

I have the following configuration:
browser ->(https)-> apache reverse proxy ->(http)-> nginx reverse proxy ->(http)-> piwigo

In this case, the variable $_SERVER['HTTP_X_FORWARDED_HOST'] on Piwigo does not hold the hostname currently expected in Piwigo code (see https://github.com/Piwigo/Piwigo/blob/master/include/functions_url.inc.php#L52), but a comma-separated list of hostnames. In my case it was twice the right one: myhostname, myhostname

The result was a broken batch resize feature, because the API returned invalid URLs like:
https://myhostname, myhostname/i.php?...
where it should be:
https://myhostname/i.php?...

I managed to workaround that by adding the following lines in local/config/config.inc.php. When there is a comma in this variable, it keeps only the first value (the one before the first comma):

if ($_SERVER['HTTP_X_FORWARDED_HOST'] && strpos($_SERVER['HTTP_X_FORWARDED_HOST'], ',') !== FALSE){
  $_SERVER['HTTP_X_FORWARDED_HOST'] = explode(',',$_SERVER['HTTP_X_FORWARDED_HOST'])[0];
}

I think that this logic should be in https://github.com/Piwigo/Piwigo/blob/master/include/functions_url.inc.php#L52

That's how some other projects implemented it. See https://github.com/xp-framework/xp-framework/issues/162 , https://github.com/RicoSuter/NSwag/issues/2370 , https://github.com/pallets/werkzeug/issues/371 or https://bz.apache.org/bugzilla/show_bug.cgi?id=57665#c14

I can create a PR if you want.

I have the following configuration: `browser ->(https)-> apache reverse proxy ->(http)-> nginx reverse proxy ->(http)-> piwigo` In this case, the variable `$_SERVER['HTTP_X_FORWARDED_HOST']` on Piwigo does not hold the hostname currently expected in Piwigo code (see https://github.com/Piwigo/Piwigo/blob/master/include/functions_url.inc.php#L52), but a comma-separated list of hostnames. In my case it was twice the right one: `myhostname, myhostname` The result was a broken batch resize feature, because the API returned invalid URLs like: `https://myhostname, myhostname/i.php?...` where it should be: `https://myhostname/i.php?...` I managed to workaround that by adding the following lines in `local/config/config.inc.php`. When there is a comma in this variable, it keeps only the first value (the one before the first comma): ``` if ($_SERVER['HTTP_X_FORWARDED_HOST'] && strpos($_SERVER['HTTP_X_FORWARDED_HOST'], ',') !== FALSE){ $_SERVER['HTTP_X_FORWARDED_HOST'] = explode(',',$_SERVER['HTTP_X_FORWARDED_HOST'])[0]; } ``` I think that this logic should be in https://github.com/Piwigo/Piwigo/blob/master/include/functions_url.inc.php#L52 That's how some other projects implemented it. See https://github.com/xp-framework/xp-framework/issues/162 , https://github.com/RicoSuter/NSwag/issues/2370 , https://github.com/pallets/werkzeug/issues/371 or https://bz.apache.org/bugzilla/show_bug.cgi?id=57665#c14 I can create a PR if you want. <!-- github-sync-id:1284963928 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#1470