4 ms·

not PHP bug, but Apache bug: "However, major web servers such as Apache by default set the SERVER_NAME variable using the hostname supplied by the client (withi

by gondo 9y ago

not PHP bug, but Apache bug: "However, major web servers such as Apache by default set the SERVER_NAME variable using the hostname supplied by the client (within the HTTP_HOST header):"

mintplant 9y ago
Not an Apache bug but Wordpress trusting client-supplied data where it shouldn't. SERVER_NAME coming from the HTTP Host header is intentional and documented behavior, ergo not a bug.
- m_mueller 9y ago
  How is this behavior ever useful server side?
  - mintplant 9y ago
    I dunno. My best guess would be that it's there for legacy reasons.
edoceo 9y ago
Not even an Apache bug, it's a config parameter where one case is dangerous but still maybe useful (but I can't think of example). The recommendation, if followed, mitigates