Index: includes/bootstrap.inc =================================================================== RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v retrieving revision 1.145.2.12 diff -u -p -r1.145.2.12 bootstrap.inc --- includes/bootstrap.inc 10 Dec 2008 18:16:03 -0000 1.145.2.12 +++ includes/bootstrap.inc 14 Jan 2009 17:01:57 -0000 @@ -240,6 +240,9 @@ function drupal_unset_globals() { * TRUE if only containing valid characters, or FALSE otherwise. */ function drupal_valid_http_host() { + if ($_SERVER['HTTP_HOST'] == '') { + return TRUE; + } $_SERVER['HTTP_HOST'] = strtolower($_SERVER['HTTP_HOST']); return preg_match('/^\[?(?:[a-z0-9-:\]_]+\.?)+$/', $_SERVER['HTTP_HOST']); } @@ -255,6 +258,12 @@ function conf_init() { global $db_url, $db_prefix, $cookie_domain, $conf, $installed_profile; $conf = array(); + // Some pre-HTTP/1.1 clients will not send a Host header. Ensure the key is + // defined for E_ALL compliance. + if (!isset($_SERVER['HTTP_HOST'])) { + $_SERVER['HTTP_HOST'] = ''; + } + if (!drupal_valid_http_host()) { // HTTP_HOST is invalid, e.g. if containing slashes it may be an attack. header('HTTP/1.1 400 Bad Request');