Security: Prevent Host Header Injection attacks#1071

Merged

markstory merged 3 commits intocakephp:5.xfrom

dereuromark:security-fix-host-header-injection

Nov 25, 2025

Commits on Nov 24, 2025

Security: Prevent Host Header Injection attacks
dereuromark
committed
Fix PHPStan failure by only enforcing fullBaseUrl in web context

dereuromark
and
claude
committed

Commits on Nov 25, 2025

Keep defaulting.
dereuromark
committed