--- includes/bootstrap.inc.orig	2007-10-17 09:03:03.000000000 -0400
+++ includes/bootstrap.inc	2007-10-20 14:41:09.000000000 -0400
@@ -238,6 +238,7 @@
 
   $confdir = 'sites';
   $uri = explode('/', $_SERVER['SCRIPT_NAME'] ? $_SERVER['SCRIPT_NAME'] : $_SERVER['SCRIPT_FILENAME']);
+  $_SERVER['HTTP_HOST'] = isset($_SERVER['HTTP_X_FORWARDED_HOST'] ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST']);
   $server = explode('.', implode('.', array_reverse(explode(':', rtrim($_SERVER['HTTP_HOST'], '.')))));
   for ($i = count($uri) - 1; $i > 0; $i--) {
     for ($j = count($server); $j > 0; $j--) {
@@ -297,6 +298,7 @@
 
     // As $_SERVER['HTTP_HOST'] is user input, ensure it only contains
     // characters allowed in hostnames.
+    $_SERVER['HTTP_HOST'] = isset($_SERVER['HTTP_X_FORWARDED_HOST'] ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST']);
     $base_url = $base_root .= '://'. preg_replace('/[^a-z0-9-:._]/i', '', $_SERVER['HTTP_HOST']);
 
     // $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
@@ -321,6 +323,7 @@
     list( , $session_name) = explode('://', $base_url, 2);
     // We escape the hostname because it can be modified by a visitor.
     if (!empty($_SERVER['HTTP_HOST'])) {
+      $_SERVER['HTTP_HOST'] = isset($_SERVER['HTTP_X_FORWARDED_HOST'] ? $_SERVER['HTTP_X_FORWARDED_HOST'] : $_SERVER['HTTP_HOST']);
       $cookie_domain = check_plain($_SERVER['HTTP_HOST']);
     }
   }