getkirby / kirby

Kirby's core application folder
https://getkirby.com
Other
1.32k stars 168 forks source link

[3.6.3-rc.1] `Environment` doesn't check the path in array `url` options #4191

Closed lukasbestle closed 2 years ago

lukasbestle commented 2 years ago

Description

If the url option is configured as array, Kirby only checks the hostnames that are contained in these configured allowed URLs. If the configured URLs contain paths, these are neither checked nor used for the system index URL.

Expected behavior

The Environment should match the full detected index URL against the configured array, not just the hostname. If the path is invalid, no match will be found and the exception should be thrown.

Additional context

The issue comes from this line:

https://github.com/getkirby/kirby/blob/e891e3e517551e04facd52a90d6e7e474a8f992b/src/Cms/Environment.php#L85

The full $url is basically thrown away at this point.

To reproduce

config.php:

<?php

return [
    'debug' => true,
    'url' => [
        'https://example.com/my-site/',
        'http://localhost/my-expected-path/',
    ],
];

Actual (detected) index URL: http://localhost/my-actual-path

Code in any template:

echo url('my-page');

Output:

http://localhost/my-actual-path/my-page

Your setup

Kirby Version

3.6.3-rc.1

bastianallgeier commented 2 years ago