Re: [Phpwiki-talk] Bug#168137: phpwiki: HTTP_HOST should be used instead of SERVER_NAME in config.php (fwd)

[Jeff D. <da...@da...>]

Thanks for passing on the report, Matthew.

> Is this a problem which the PHPWiki authors feel is a real problem?

I think this is a non-bug.

According to the CGI spec (http://hoohoo.ncsa.uiuc.edu/cgi/env.html)
SERVER_NAME should be "The server's hostname, DNS alias, or IP address
as it would appear in self-referencing URLs."

So if SERVER_NAME is not what you want in self-referencing URLs, I
say it's an Apache configuration problem.

SERVER_NAME can be explicitly set in the apache config file
using the ServerName directive.   See:
  http://httpd.apache.org/docs/mod/core.html#servername


If he doesn't want to muck with the Apache config, the PhpWiki admin
can also explicitly define PhpWiki's SERVER_NAME in the PhpWiki config
file (index.php).   $HTTP_SERVER_VARS['SERVER_NAME']
is only used as the default when the admin hasn't specified a
value for SERVER_NAME in the config file.

(The PhpWiki admin is, of course also allowed to put something like
  define('SERVER_NAME', $_SERVER['HTTP_HOST']);
into index.php if that's really what s/he wants.)


 
I'm reluctant to make changes in PhpWiki's auto-config defaults
based on problems dealing with cases where the hosts IP does not
map to a resolable host-name --- it seems that's what manual
configuration is for.

As far as what to use for the default, auto-detected case,
it's not clear to me that $HTTP_SERVER_VARS['HTTP_HOST'] would
work better than $HTTP_SERVER_VARS['SERVER_NAME'] in the majority
of cases. 

Another concern is that, 'HTTP_HOST' comes from the browser 
(client), passed in one of the Host: header of the HTTP request ---
so there may be some security issues involved as well.



The real intended use of HTTP_HOST is for use in virtual hosting
situations where multiple virtual hosts share the same IP address.
Generally, it's used by the server (apache) to determine which 
virtual host to direct the request to...