0

Are there any disadvantages to using the following code to setup WP_HOME and WP_SITEURL in wp.config for both singlesite installs and multisite installs:

/**
* Site Host URLs
*/

$hostname = $_SERVER['HTTP_HOST'];
if(isset($_SERVER['HTTP_X_FORWARDED_HOST']) && !empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
    $hostname = $_SERVER['HTTP_X_FORWARDED_HOST'];
}

$protocol = isset($_SERVER['HTTPS']) 
                && ($_SERVER['HTTPS'] == 'on' 
                || $_SERVER['HTTPS'] == 1)
            || isset($_SERVER['HTTP_X_FORWARDED_PROTO'])
                && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'
            ? 'https://'
            : 'http://';

$siteUrl = $protocol . rtrim($hostname, '/');

define('WP_HOME', $siteUrl);
define('WP_SITEURL', $siteUrl);

I know I do not have much of a reputation to offer as a bounty but your answer will get my 100% appreciation.

0

The obvious problem is that you are trusting user input (http headers) which makes your code suspicious from security POV.

Other then that, no real problems with it, but my experience is that such hacks have a tendency to just move whatever problem you are trying to solve this way to another place.

  • Yes, I definitely ignored [stackoverflow.com/questions/6474783/…. What are the alternatives in your opinion? Especially for multisite? – CandyCoated Apr 5 '16 at 16:10
  • @CandyCoated, can you edit the question to give more context, for example what issue with multisite are you trying to avoid like this? – Mark Kaplun Apr 5 '16 at 16:34
0

As far as i can see (2 years wordpress/woocommerce) i have always used WP_HOME and WP_SITEURL. Makes it very easy to move site from one domain to another, never had any issues with it even when moving ecommerce shops. You might want to go to admin panel and save permalinks there so they would be updated in DB, but usually it is not necessary.

NB! It won't update any kind links (a, img src etc) that have been saved to database. For ex if you have a blog on domain domainA.com where you have inserted images through WYSIWYG editor and now you move to domainB.com then all images in your blog content will still try to load from domainA.com. This is because WYSIWYG saves full length links even when they are from your own domain to database. If you have such content then you will have to perform search and replace against that database.

Currently no more issues are coming to my head, but if i remember something i will update this post.

Edit

Like Mark already mentioned there is a security risk when trusting

$_SERVER['HTTP_X_FORWARDED_HOST']

because user can easily set that header himself.

0

I've used a similar approach on many CMS projects throughout the years. It works really well for rapid development, but it does have issues.

If you can trust that the web server (apache, nginx) are configured correctly, you could use $_SERVER['SERVER_NAME'] to retrieve the hostname as configured by the webserver. (Reference: https://stackoverflow.com/questions/2297403/http-host-vs-server-name)

That said, HTTP_HOST is certainly more flexible!

If I don't have control over server configs, I'll generally specify a set of "allowed" hosts that can be set, and a sensible default. For example:

/**
* Site Host URLs
*/

$hostname = $_SERVER['HTTP_HOST'];
if(!empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
    $hostname = $_SERVER['HTTP_X_FORWARDED_HOST'];
}

$hostname = rtrim($hostname, '/');

$allowed = ['www.foo.com', 'dev.foo.com', 'staging.foo.com'];

if (!in_array($hostname, $allowed)) {
    $hostname = 'www.foo.com';
}

$protocol = (!empty($_SERVER['HTTPS']) || !empty($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'))
            ? 'https://'
            : 'http://';

$siteUrl = $protocol . $hostname;

define('WP_HOME', $siteUrl);
define('WP_SITEURL', $siteUrl);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.