Aug 21 - Fixed Forwarded host

app/__init__.py

@@ -85,8 +85,17 @@ def create_app(config_name='default'):
     # Unwrap X-Forwarded-For / X-Forwarded-Proto set by Nginx so Flask sees
     # the real client IP (needed for rate limiting and fail2ban logging) and
     # the real scheme (needed for HTTPS URL generation in emails).
+    #
+    # MT-24: x_host is deliberately 0. With x_host=1, `request.host` was taken
+    # from the X-Forwarded-Host header — and nginx forwards unrecognised client
+    # headers upstream, so any client could supply that header and choose which
+    # tenant database the request bound to. Nginx already sets `Host $host`
+    # from the real SNI/Host, so HTTP_HOST is the trustworthy source and
+    # X-Forwarded-Host adds nothing but an attacker-controlled input.
+    # The nginx configs also pin X-Forwarded-Host explicitly (defence in depth);
+    # neither layer alone is relied upon. See deploy/nginx/README.md.
     from werkzeug.middleware.proxy_fix import ProxyFix
-    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
+    app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=0)
 
     db.init_app(app)
     login_manager.init_app(app)