lib/private/Security/TrustedDomainHelper.php
/**
	 * Checks whether a domain is considered as trusted from the list
	 * of trusted domains. If no trusted domains have been configured, returns
	 * true.
	 * This is used to prevent Host Header Poisoning.
	 * @param string $domainWithPort
	 * @return bool true if the given domain is trusted or if no trusted domains
	 * have been configured
	 */
Checks whether a domain is considered as trusted from the list
of trusted domains. If no trusted domains have been configured, returns
true.
This is used to prevent Host Header Poisoning.
@param string $domainWithPort
@return bool true if the given domain is trusted or if no trusted domains
have been configured
Checks whether a domain is considered as trusted from the list of trusted domains . If no trusted domains have been configured returns true . This is used to prevent Host Header Poisoning . @param string $domainWithPort @return bool true if the given domain is trusted or if no trusted domains have been configured
public function isTrustedDomain($domainWithPort) {
		$domain = $this->getDomainWithoutPort($domainWithPort);
		$trustedList = $this->config->getSystemValue('trusted_domains', []);
		if (!is_array($trustedList)) {
			return false;
		}
		if (preg_match(Request::REGEX_LOCALHOST, $domain) === 1) {
			return true;
		}
		if (strpos($domain,'-') === 0 || strpos($domain,'..') !== false) {
			return false;
		}
		foreach ($trustedList as $trusted) {
			if (gettype($trusted) !== 'string') {
				break;
			}
			$regex = '/^' . join('[-\.a-zA-Z0-9]*', array_map(function($v) { return preg_quote($v, '/'); }, explode('*', $trusted))) . '$/';
			if (preg_match($regex, $domain) || preg_match($regex, $domainWithPort)) {
 				return true;
 			}
 		}
 		return false;
	}
public function isTrustedDomain ( $ domainWithPort ) { $ domain = $ this -> getDomainWithoutPort ( $ domainWithPort ) ; $ trustedList = $ this -> config -> getSystemValue ( 'trusted_domains' , [ ] ) ; if ( ! is_array ( $ trustedList ) ) { return false ; } if ( preg_match ( Request :: REGEX_LOCALHOST , $ domain ) === 1 ) { return true ; } if ( strpos ( $ domain , '-' ) === 0 || strpos ( $ domain , '..' ) !== false ) { return false ; } foreach ( $ trustedList as $ trusted ) { if ( gettype ( $ trusted ) !== 'string' ) { break ; } $ regex = '/^' . join ( '[-\.a-zA-Z0-9]*' , array_map ( function ( $ v ) { return preg_quote ( $ v , '/' ) ; } , explode ( '*' , $ trusted ) ) ) . '$/' ; if ( preg_match ( $ regex , $ domain ) || preg_match ( $ regex , $ domainWithPort ) ) { return true ; } } return false ; }
Checks whether a domain is considered as trusted from the list
 of trusted domains.
Checks whether a domain is considered as trusted from the list of trusted domains .
// Read trusted domains from config // Always allow access from localhost // Reject misformed domains in any case // Match, allowing for * wildcards