Remove HTTP_HOST

[wesbaker]

Since HTTP_HOST is insecure, I've replaced it's use in config.master.php with a constant (ENV_DOMAIN) that's set in config.env.php based on the URL of the current environment. Ultimately, every domain must be set ahead of time so you know you're only using domains that you've approved.

[peteeveleigh]

I'm probably mistaken but doesn't the fact that the database creds are only set for domains contained within the switch statement make this change moot?

I have seen multi config setups where the default option is the production domain creds which I can see being a problem.

In this case the default option is for local - so presuming the "local" db is not going to be accessible to the site then nothing would function.

[wesbaker]

I'm probably mistaken but doesn't the fact that the database creds are only set for domains contained within the switch statement make this change moot?

Well, the problem is with the default. In the case of an attack where HTTP_HOST is different from any of the previous cases it's going to use config.local.php. If your database credentials are the same in production as they are locally, you do have an issue.

[derekjones]

@erikreagan do any modifications need to be made to this pull request before this is merged in?

[wesbaker]

Is there a change you guys need me to make? We're 23 days out from my pull request with no response.

[aaronlax]

@wesbaker @derekjones Thanks guys! Sorry for the delay in getting this merged!

[derekjones]

Thanks @aaronlax!

[damienbuckley]

Do the changes made here apply also to the EE2 version? I only see the changes having been merged into the EE3 branch

[wesbaker]

@damienbuckley yes, the same changes should also be made to the EE2 version.