[RSS Feed/News] XF\Http\Request#isHostLocal returns true for *.dev

Status
Not open for further replies.

XenForo

Administrative
  • Thread starter
  • Admin
  • #1
dev is a public TLD; you can go out and buy [whatever].dev: Hello .dev However, isHostLocal treats .dev domains as local, despite .dev not being a reserved TLD.

Within XF's core and first-party add-ons as of writing, isHostLocal is only ever used in the context of the expression: $request->isSecure() || $request->isHostLocal(). By sheer luck, dev has HSTS enabled for the entire TLD, so this bug is...

Read more

ادامه مطلب...
 
Status
Not open for further replies.
Back
Top Bottom