<?php

/**

* @link https://www.yiiframework.com/

* @copyright Copyright (c) 2008 Yii Software LLC

* @license https://www.yiiframework.com/license/

*/

namespace yii\web;

use Yii;

use yii\base\InvalidConfigException;

use yii\validators\IpValidator;

/**

* The web Request class represents an HTTP request.

*

* It encapsulates the $_SERVER variable and resolves its inconsistency among different Web servers.

* Also it provides an interface to retrieve request parameters from $_POST, $_GET, $_COOKIES and REST

* parameters sent via other HTTP methods like PUT or DELETE.

*

* Request is configured as an application component in [[\yii\web\Application]] by default.

* You can access that instance via `Yii::$app->request`.

*

* For more details and usage information on Request, see the [guide article on requests](guide:runtime-requests).

*

* @property string|null $hostInfo Schema and hostname part (with port number if needed) of the request URL

* (e.g. `https://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set. See

* [[getHostInfo()]] for security related notes on this property.

* @property-read string $absoluteUrl The currently requested absolute URL.

* @property array $acceptableContentTypes The content types ordered by the quality score. Types with the

* highest scores will be returned first. The array keys are the content types, while the array values are the

* corresponding quality score and other parameters as given in the header.

* @property array $acceptableLanguages The languages ordered by the preference level. The first element

* represents the most preferred language.

* @property-read array $authCredentials That contains exactly two elements: - 0: the username sent via HTTP

* authentication, `null` if the username is not given - 1: the password sent via HTTP authentication, `null` if

* the password is not given.

* @property-read string|null $authPassword The password sent via HTTP authentication, `null` if the password

* is not given.

* @property-read string|null $authUser The username sent via HTTP authentication, `null` if the username is

* not given.

* @property string $baseUrl The relative URL for the application.

* @property array|object $bodyParams The request parameters given in the request body.

* @property-read string $contentType Request content-type. Empty string is returned if this information is

* not available.

* @property-read CookieCollection $cookies The cookie collection.

* @property-read null|string $csrfToken The token used to perform CSRF validation. Null is returned if the

* [[validateCsrfHeaderOnly]] is true.

* @property-read string|null $csrfTokenFromHeader The CSRF token sent via [[csrfHeader]] by browser. Null is

* returned if no such header is sent.

* @property-read array $eTags The entity tags.

* @property-read HeaderCollection $headers The header collection.

* @property-read string|null $hostName Hostname part of the request URL (e.g. `www.yiiframework.com`).

* @property-read bool $isAjax Whether this is an AJAX (XMLHttpRequest) request.

* @property-read bool $isDelete Whether this is a DELETE request.

* @property-read bool $isFlash Whether this is an Adobe Flash or Adobe Flex request.

* @property-read bool $isGet Whether this is a GET request.

* @property-read bool $isHead Whether this is a HEAD request.

* @property-read bool $isOptions Whether this is a OPTIONS request.

* @property-read bool $isPatch Whether this is a PATCH request.

* @property-read bool $isPjax Whether this is a PJAX request.

* @property-read bool $isPost Whether this is a POST request.

* @property-read bool $isPut Whether this is a PUT request.

* @property-read bool $isSecureConnection If the request is sent via secure channel (https).

* @property-read string $method Request method, such as GET, POST, HEAD, PUT, PATCH, DELETE. The value

* returned is turned into upper case.

* @property-read string|null $origin URL origin of a CORS request, `null` if not available.

* @property string $pathInfo Part of the request URL that is after the entry script and before the question

* mark. Note, the returned path info is already URL-decoded.

* @property int $port Port number for insecure requests.

* @property array $queryParams The request GET parameter values.

* @property-read string $queryString Part of the request URL that is after the question mark.

* @property string $rawBody The request body.

* @property-read string|null $referrer URL referrer, null if not available.

* @property-read string|null $remoteHost Remote host name, `null` if not available.

* @property-read string|null $remoteIP Remote IP address, `null` if not available.

* @property string $scriptFile The entry script file path.

* @property string $scriptUrl The relative URL of the entry script.

* @property int $securePort Port number for secure requests.

* @property-read string|null $serverName Server name, null if not available.

* @property-read int|null $serverPort Server port number, null if not available.

* @property string $url The currently requested relative URL. Note that the URI returned may be URL-encoded

* depending on the client.

* @property-read string|null $userAgent User agent, null if not available.

* @property-read string|null $userHost User host name, null if not available.

* @property-read string|null $userIP User IP address, null if not available.

*

* @author Qiang Xue <[email protected]>

* @since 2.0

*/

class Request extends \yii\base\Request

{

/**

* Default name of the HTTP header for sending CSRF token.

*/

public const CSRF_HEADER = 'X-CSRF-Token';

/**

* The length of the CSRF token mask.

* @deprecated since 2.0.12. The mask length is now equal to the token length.

*/

public const CSRF_MASK_LENGTH = 8;

/**

* @var bool whether to enable CSRF (Cross-Site Request Forgery) validation. Defaults to true.

* When CSRF validation is enabled, forms submitted to an Yii Web application must be originated

* from the same application. If not, a 400 HTTP exception will be raised.

*

* Note, this feature requires that the user client accepts cookie. Also, to use this feature,

* forms submitted via POST method must contain a hidden input whose name is specified by [[csrfParam]].

* You may use [[\yii\helpers\Html::beginForm()]] to generate his hidden input.

*

* In JavaScript, you may get the values of [[csrfParam]] and [[csrfToken]] via `yii.getCsrfParam()` and

* `yii.getCsrfToken()`, respectively. The [[\yii\web\YiiAsset]] asset must be registered.

* You also need to include CSRF meta tags in your pages by using [[\yii\helpers\Html::csrfMetaTags()]].

*

* For SPA, you can use CSRF validation by custom header with a random or an empty value.

* Include a header with the name specified by [[csrfHeader]] to requests that must be validated.

* Warning! CSRF validation by custom header can be used only for same-origin requests or

* with CORS configured to allow requests from the list of specific origins only.

*

* @see Controller::enableCsrfValidation

* @see https://en.wikipedia.org/wiki/Cross-site_request_forgery

*/

public $enableCsrfValidation = true;

/**

* @var string the name of the HTTP header for sending CSRF token. Defaults to [[CSRF_HEADER]].

* This property may be changed for Yii API applications only.

* Don't change this property for Yii Web application.

*/

public $csrfHeader = self::CSRF_HEADER;

/**

* @var array the name of the HTTP header for sending CSRF token.

* by default validate CSRF token on non-"safe" methods only

* This property is used only when [[enableCsrfValidation]] is true.

* @see https://datatracker.ietf.org/doc/html/rfc9110#name-safe-methods

*/

public $csrfTokenSafeMethods = ['GET', 'HEAD', 'OPTIONS'];

/**

* @var array "unsafe" methods not triggered a CORS-preflight request

* This property is used only when both [[enableCsrfValidation]] and [[validateCsrfHeaderOnly]] are true.

* @see https://fetch.spec.whatwg.org/#http-cors-protocol

*/

public $csrfHeaderUnsafeMethods = ['GET', 'HEAD', 'POST'];

/**

* @var bool whether to use custom header only to CSRF validation of SPA. Defaults to false.

* If false and [[enableCsrfValidation]] is true, CSRF validation by token will used.

* Warning! CSRF validation by custom header can be used for Yii API applications only.

* @see https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi

*/

public $validateCsrfHeaderOnly = false;

/**

* @var string the name of the token used to prevent CSRF. Defaults to '_csrf'.

* This property is used only when [[enableCsrfValidation]] is true.

*/

public $csrfParam = '_csrf';

/**

* @var array the configuration for creating the CSRF [[Cookie|cookie]]. This property is used only when

* both [[enableCsrfValidation]] and [[enableCsrfCookie]] are true.

*/

public $csrfCookie = ['httpOnly' => true];

/**

* @var bool whether to use cookie to persist CSRF token. If false, CSRF token will be stored

* in session under the name of [[csrfParam]]. Note that while storing CSRF tokens in session increases

* security, it requires starting a session for every page, which will degrade your site performance.

*/

public $enableCsrfCookie = true;

/**

* @var bool whether cookies should be validated to ensure they are not tampered. Defaults to true.

*/

public $enableCookieValidation = true;

/**

* @var string a secret key used for cookie validation. This property must be set if [[enableCookieValidation]] is true.

*/

public $cookieValidationKey;

/**

* @var string the name of the POST parameter that is used to indicate if a request is a PUT, PATCH or DELETE

* request tunneled through POST. Defaults to '_method'.

* @see getMethod()

* @see getBodyParams()

*/

public $methodParam = '_method';

/**

* @var array the parsers for converting the raw HTTP request body into [[bodyParams]].

* The array keys are the request `Content-Types`, and the array values are the

* corresponding configurations for [[Yii::createObject|creating the parser objects]].

* A parser must implement the [[RequestParserInterface]].

*

* To enable parsing for JSON requests you can use the [[JsonParser]] class like in the following example:

*

* ```

* [

* 'application/json' => 'yii\web\JsonParser',

* ]

* ```

*

* To register a parser for parsing all request types you can use `'*'` as the array key.

* This one will be used as a fallback in case no other types match.

*

* @see getBodyParams()

*/

public $parsers = [];

/**

* @var array the configuration for trusted security related headers.

*

* An array key is an IPv4 or IPv6 IP address in CIDR notation for matching a client.

*

* An array value is a list of headers to trust. These will be matched against

* [[secureHeaders]] to determine which headers are allowed to be sent by a specified host.

* The case of the header names must be the same as specified in [[secureHeaders]].

*

* For example, to trust all headers listed in [[secureHeaders]] for IP addresses

* in range `192.168.0.0-192.168.0.254` write the following:

*

* ```

* [

* '192.168.0.0/24',

* ]

* ```

*

* To trust just the `X-Forwarded-For` header from `10.0.0.1`, use:

*

* ```

* [

* '10.0.0.1' => ['X-Forwarded-For']

* ]

* ```

*

* Default is to trust all headers except those listed in [[secureHeaders]] from all hosts.

* Matches are tried in order and searching is stopped when IP matches.

*

* > Info: Matching is performed using [[IpValidator]].

* See [[IpValidator::::setRanges()|IpValidator::setRanges()]]

* and [[IpValidator::networks]] for advanced matching.

*

* @see secureHeaders

* @since 2.0.13

*/

public $trustedHosts = [];

/**

* @var array lists of headers that are, by default, subject to the trusted host configuration.

* These headers will be filtered unless explicitly allowed in [[trustedHosts]].

* If the list contains the `Forwarded` header, processing will be done according to RFC 7239.

* The match of header names is case-insensitive.

* @see https://en.wikipedia.org/wiki/List_of_HTTP_header_fields

* @see https://datatracker.ietf.org/doc/html/rfc7239

* @see trustedHosts

* @since 2.0.13

*/

public $secureHeaders = [

// Common:

'X-Forwarded-For',

'X-Forwarded-Host',

'X-Forwarded-Proto',

'X-Forwarded-Port',

// Microsoft:

'Front-End-Https',

'X-Rewrite-Url',

// ngrok:

'X-Original-Host',

];

/**

* @var string[] List of headers where proxies store the real client IP.

* It's not advisable to put insecure headers here.

* To use the `Forwarded` header according to RFC 7239, the header must be added to [[secureHeaders]] list.

* The match of header names is case-insensitive.

* @see trustedHosts

* @see secureHeaders

* @since 2.0.13

*/

public $ipHeaders = [

'X-Forwarded-For', // Common

];

/**

* @var string[] List of headers where proxies store the real request port.

* It's not advisable to put insecure headers here.

* To use the `Forwarded Port`, the header must be added to [[secureHeaders]] list.

* The match of header names is case-insensitive.

* @see trustedHosts

* @see secureHeaders

* @since 2.0.46

*/

public $portHeaders = [

'X-Forwarded-Port', // Common

];

/**

* @var array list of headers to check for determining whether the connection is made via HTTPS.

* The array keys are header names and the array value is a list of header values that indicate a secure connection.

* The match of header names and values is case-insensitive.

* It's not advisable to put insecure headers here.

* @see trustedHosts

* @see secureHeaders

* @since 2.0.13

*/

public $secureProtocolHeaders = [

'X-Forwarded-Proto' => ['https'], // Common

'Front-End-Https' => ['on'], // Microsoft

];

/**

* @var CookieCollection Collection of request cookies.

*/

private $_cookies;

/**

* @var HeaderCollection Collection of request headers.

*/

private $_headers;

/**

* Resolves the current request into a route and the associated parameters.

* @return array the first element is the route, and the second is the associated parameters.

* @throws NotFoundHttpException if the request cannot be resolved.

*/

public function resolve()

{

$result = Yii::$app->getUrlManager()->parseRequest($this);

if ($result !== false) {

list($route, $params) = $result;

if ($this->_queryParams === null) {

$_GET = $params + $_GET; // preserve numeric keys

} else {

$this->_queryParams = $params + $this->_queryParams;

}

return [$route, $this->getQueryParams()];

}

throw new NotFoundHttpException(Yii::t('yii', 'Page not found.'));

}

/**

* Filters headers according to the [[trustedHosts]].

* @param HeaderCollection $headerCollection

* @since 2.0.13

*/

protected function filterHeaders(HeaderCollection $headerCollection)

{

$trustedHeaders = $this->getTrustedHeaders();

// remove all secure headers unless they are trusted

foreach ($this->secureHeaders as $secureHeader) {

if (!in_array($secureHeader, $trustedHeaders)) {

$headerCollection->remove($secureHeader);

}

}

}

/**

* Trusted headers according to the [[trustedHosts]].

* @return array

* @since 2.0.28

*/

protected function getTrustedHeaders()

{

// do not trust any of the [[secureHeaders]] by default

$trustedHeaders = [];

// check if the client is a trusted host

if (!empty($this->trustedHosts)) {

$validator = $this->getIpValidator();

$ip = $this->getRemoteIP();

foreach ($this->trustedHosts as $cidr => $headers) {

if (!is_array($headers)) {

$cidr = $headers;

$headers = $this->secureHeaders;

}

$validator->setRanges($cidr);

if ($validator->validate($ip)) {

$trustedHeaders = $headers;

break;

}

}

}

return $trustedHeaders;

}

/**

* Creates instance of [[IpValidator]].

* You can override this method to adjust validator or implement different matching strategy.

*

* @return IpValidator

* @since 2.0.13

*/

protected function getIpValidator()

{

return new IpValidator();

}

/**

* Returns the header collection.

* The header collection contains incoming HTTP headers.

* @return HeaderCollection the header collection

*/

public function getHeaders()

{

if ($this->_headers === null) {

$this->_headers = new HeaderCollection();

if (function_exists('getallheaders')) {

$headers = getallheaders();

foreach ($headers as $name => $value) {

$this->_headers->add($name, $value);

}

} elseif (function_exists('http_get_request_headers')) {

$headers = http_get_request_headers();

foreach ($headers as $name => $value) {

$this->_headers->add($name, $value);

}

} else {

// ['prefix' => length]

$headerPrefixes = ['HTTP_' => 5, 'REDIRECT_HTTP_' => 14];

foreach ($_SERVER as $name => $value) {

foreach ($headerPrefixes as $prefix => $length) {

if (strncmp($name, $prefix, $length) === 0) {

$name = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, $length)))));

$this->_headers->add($name, $value);

continue 2;

}

}

}

}

$this->filterHeaders($this->_headers);

}

return $this->_headers;

}

/**

* Returns the method of the current request (e.g. GET, POST, HEAD, PUT, PATCH, DELETE).

* @return string request method, such as GET, POST, HEAD, PUT, PATCH, DELETE.

* The value returned is turned into upper case.

*/

public function getMethod()

{

if (

isset($_POST[$this->methodParam])

// Never allow to downgrade request from WRITE methods (POST, PATCH, DELETE, etc)

// to read methods (GET, HEAD, OPTIONS) for security reasons.

&& !in_array(strtoupper($_POST[$this->methodParam]), ['GET', 'HEAD', 'OPTIONS'], true)

) {

return strtoupper($_POST[$this->methodParam]);

}

if ($this->headers->has('X-Http-Method-Override')) {

return strtoupper($this->headers->get('X-Http-Method-Override'));

}

if (isset($_SERVER['REQUEST_METHOD'])) {

return strtoupper($_SERVER['REQUEST_METHOD']);

}

return 'GET';

}

/**

* Returns whether this is a GET request.

* @return bool whether this is a GET request.

*/

public function getIsGet()

{

return $this->getMethod() === 'GET';

}

/**

* Returns whether this is an OPTIONS request.

* @return bool whether this is a OPTIONS request.

*/

public function getIsOptions()

{

return $this->getMethod() === 'OPTIONS';

}

/**

* Returns whether this is a HEAD request.

* @return bool whether this is a HEAD request.

*/

public function getIsHead()

{

return $this->getMethod() === 'HEAD';

}

/**

* Returns whether this is a POST request.

* @return bool whether this is a POST request.

*/

public function getIsPost()

{

return $this->getMethod() === 'POST';

}

/**

* Returns whether this is a DELETE request.

* @return bool whether this is a DELETE request.

*/

public function getIsDelete()

{

return $this->getMethod() === 'DELETE';

}

/**

* Returns whether this is a PUT request.

* @return bool whether this is a PUT request.

*/

public function getIsPut()

{

return $this->getMethod() === 'PUT';

}

/**

* Returns whether this is a PATCH request.

* @return bool whether this is a PATCH request.

*/

public function getIsPatch()

{

return $this->getMethod() === 'PATCH';

}

/**

* Returns whether this is an AJAX (XMLHttpRequest) request.

*

* Note that in case of cross domain requests, browser doesn't set the X-Requested-With header by default:

* https://stackoverflow.com/questions/8163703/cross-domain-ajax-doesnt-send-x-requested-with-header

*

* In case you are using `fetch()`, pass header manually:

*

* ```

* fetch(url, {

* method: 'GET',

* headers: {'X-Requested-With': 'XMLHttpRequest'}

* })

* ```

*

* @return bool whether this is an AJAX (XMLHttpRequest) request.

*/

public function getIsAjax()

{

return $this->headers->get('X-Requested-With') === 'XMLHttpRequest';

}

/**

* Returns whether this is a PJAX request.

* @return bool whether this is a PJAX request

*/

public function getIsPjax()

{

return $this->getIsAjax() && $this->headers->has('X-Pjax');

}

/**

* Returns whether this is an Adobe Flash or Flex request.

* @return bool whether this is an Adobe Flash or Adobe Flex request.

*/

public function getIsFlash()

{

$userAgent = $this->headers->get('User-Agent', '');

return stripos($userAgent, 'Shockwave') !== false

|| stripos($userAgent, 'Flash') !== false;

}

private $_rawBody;

/**

* Returns the raw HTTP request body.

* @return string the request body

*/

public function getRawBody()

{

if ($this->_rawBody === null) {

$this->_rawBody = file_get_contents('php://input');

}

return $this->_rawBody;

}

/**

* Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests.

* @param string $rawBody the request body

*/

public function setRawBody($rawBody)

{

$this->_rawBody = $rawBody;

}

/** @var array|object */

private $_bodyParams;

/**

* Returns the request parameters given in the request body.

*

* Request parameters are determined using the parsers configured in [[parsers]] property.

* If no parsers are configured for the current [[contentType]] it uses the PHP function `mb_parse_str()`

* to parse the [[rawBody|request body]].

* @return array|object the request parameters given in the request body.

* @throws \yii\base\InvalidConfigException if a registered parser does not implement the [[RequestParserInterface]].

* @see getMethod()

* @see getBodyParam()

* @see setBodyParams()

*/

public function getBodyParams()

{

if ($this->_bodyParams === null) {

if (isset($_POST[$this->methodParam])) {

$this->_bodyParams = $_POST;

unset($this->_bodyParams[$this->methodParam]);

return $this->_bodyParams;

}

$rawContentType = $this->getContentType();

if (($pos = strpos((string)$rawContentType, ';')) !== false) {

// e.g. text/html; charset=UTF-8

$contentType = substr($rawContentType, 0, $pos);

} else {

$contentType = $rawContentType;

}

if (isset($this->parsers[$contentType])) {

$parser = Yii::createObject($this->parsers[$contentType]);

if (!($parser instanceof RequestParserInterface)) {

throw new InvalidConfigException("The '$contentType' request parser is invalid. It must implement the yii\\web\\RequestParserInterface.");

}

$this->_bodyParams = $parser->parse($this->getRawBody(), $rawContentType);

} elseif (isset($this->parsers['*'])) {

$parser = Yii::createObject($this->parsers['*']);

if (!($parser instanceof RequestParserInterface)) {

throw new InvalidConfigException('The fallback request parser is invalid. It must implement the yii\\web\\RequestParserInterface.');

}

$this->_bodyParams = $parser->parse($this->getRawBody(), $rawContentType);

} elseif ($this->getMethod() === 'POST') {

// PHP has already parsed the body so we have all params in $_POST

$this->_bodyParams = $_POST;

} else {

$this->_bodyParams = [];

mb_parse_str($this->getRawBody(), $this->_bodyParams);

}

}

return $this->_bodyParams;

}

/**

* Sets the request body parameters.

*

* @param array|object $values the request body parameters (name-value pairs)

* @see getBodyParams()

*/

public function setBodyParams($values)

{

$this->_bodyParams = $values;

}

/**

* Returns the named request body parameter value.

*

* If the parameter does not exist, the second parameter passed to this method will be returned.

*

* @param string $name the parameter name

* @param mixed $defaultValue the default parameter value if the parameter does not exist.

* @return mixed the parameter value

* @see getBodyParams()

* @see setBodyParams()

*/

public function getBodyParam($name, $defaultValue = null)

{

$params = $this->getBodyParams();

if (is_object($params)) {

// unable to use `ArrayHelper::getValue()` due to different dots in key logic and lack of exception handling

try {

return isset($params->{$name}) ? $params->{$name} : $defaultValue;

} catch (\Exception $e) {

return $defaultValue;

}

}

return isset($params[$name]) ? $params[$name] : $defaultValue;

}

/**

* Returns POST parameter with a given name. If name isn't specified, returns an array of all POST parameters.

*

* @param string|null $name the parameter name

* @param mixed $defaultValue the default parameter value if the parameter does not exist.

* @return ($name is null ? array|object : mixed)

*/

public function post($name = null, $defaultValue = null)

{

if ($name === null) {

return $this->getBodyParams();

}

return $this->getBodyParam($name, $defaultValue);

}

/** @var array */

private $_queryParams;

/**

* Returns the request parameters given in the [[queryString]].

*

* This method will return the contents of `$_GET` if params where not explicitly set.

* @return array the request GET parameter values.

* @see setQueryParams()

*/

public function getQueryParams()

{

if ($this->_queryParams === null) {

return $_GET;

}

return $this->_queryParams;

}

/**

* Sets the request [[queryString]] parameters.

* @param array $values the request query parameters (name-value pairs)

* @see getQueryParam()

* @see getQueryParams()

*/

public function setQueryParams($values)

{

$this->_queryParams = $values;

}

/**

* Returns GET parameter with a given name. If name isn't specified, returns an array of all GET parameters.

*

* @param string|null $name the parameter name

* @param mixed $defaultValue the default parameter value if the parameter does not exist.

* @return ($name is null ? array : mixed)

*/

public function get($name = null, $defaultValue = null)

{

if ($name === null) {

return $this->getQueryParams();

}

return $this->getQueryParam($name, $defaultValue);

}

/**

* Returns the named GET parameter value.

* If the GET parameter does not exist, the second parameter passed to this method will be returned.

* @param string $name the GET parameter name.

* @param mixed $defaultValue the default parameter value if the GET parameter does not exist.

* @return mixed the GET parameter value

* @see getBodyParam()

*/

public function getQueryParam($name, $defaultValue = null)

{

$params = $this->getQueryParams();

return isset($params[$name]) ? $params[$name] : $defaultValue;

}

private $_hostInfo;

private $_hostName;

/**

* Returns the schema and host part of the current request URL.

*

* The returned URL does not have an ending slash.

*

* By default this value is based on the user request information. This method will

* return the value of `$_SERVER['HTTP_HOST']` if it is available or `$_SERVER['SERVER_NAME']` if not.

* You may want to check out the [PHP documentation](https://www.php.net/manual/en/reserved.variables.server.php)

* for more information on these variables.

*

* You may explicitly specify it by setting the [[setHostInfo()|hostInfo]] property.

*

* > Warning: Dependent on the server configuration this information may not be

* > reliable and [may be faked by the user sending the HTTP request](https://www.acunetix.com/vulnerabilities/web/host-header-attack).

* > If the webserver is configured to serve the same site independent of the value of

* > the `Host` header, this value is not reliable. In such situations you should either

* > fix your webserver configuration or explicitly set the value by setting the [[setHostInfo()|hostInfo]] property.

* > If you don't have access to the server configuration, you can setup [[\yii\filters\HostControl]] filter at

* > application level in order to protect against such kind of attack.

*

* @return string|null schema and hostname part (with port number if needed) of the request URL

* (e.g. `https://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set.

* @see setHostInfo()

*/

public function getHostInfo()

{

if ($this->_hostInfo === null) {

$secure = $this->getIsSecureConnection();

$http = $secure ? 'https' : 'http';

if ($this->getSecureForwardedHeaderTrustedPart('host') !== null) {

$this->_hostInfo = $http . '://' . $this->getSecureForwardedHeaderTrustedPart('host');

} elseif ($this->headers->has('X-Forwarded-Host')) {

$this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Forwarded-Host'))[0]);

} elseif ($this->headers->has('X-Original-Host')) {

$this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Original-Host'))[0]);

} elseif ($this->headers->has('Host')) {

$this->_hostInfo = $http . '://' . $this->headers->get('Host');

} elseif (isset($_SERVER['SERVER_NAME'])) {

$this->_hostInfo = $http . '://' . $_SERVER['SERVER_NAME'];

$port = $secure ? $this->getSecurePort() : $this->getPort();

if (($port !== 80 && !$secure) || ($port !== 443 && $secure)) {

$this->_hostInfo .= ':' . $port;

}

}

}

return $this->_hostInfo;

}

/**

* Sets the schema and host part of the application URL.

* This setter is provided in case the schema and hostname cannot be determined

* on certain Web servers.

* @param string|null $value the schema and host part of the application URL. The trailing slashes will be removed.

* @see getHostInfo() for security related notes on this property.

*/

public function setHostInfo($value)

{

$this->_hostName = null;

$this->_hostInfo = $value === null ? null : rtrim($value, '/');

}

/**

* Returns the host part of the current request URL.

* Value is calculated from current [[getHostInfo()|hostInfo]] property.

*

* > Warning: The content of this value may not be reliable, dependent on the server

* > configuration. Please refer to [[getHostInfo()]] for more information.

*

* @return string|null hostname part of the request URL (e.g. `www.yiiframework.com`)

* @see getHostInfo()

* @since 2.0.10

*/

public function getHostName()

{

if ($this->_hostName === null) {

$this->_hostName = parse_url((string)$this->getHostInfo(), PHP_URL_HOST);

}

return $this->_hostName;

}

private $_baseUrl;

/**

* Returns the relative URL for the application.

* This is similar to [[scriptUrl]] except that it does not include the script file name,

* and the ending slashes are removed.

* @return string the relative URL for the application

* @see setScriptUrl()

*/

public function getBaseUrl()

{

if ($this->_baseUrl === null) {

$this->_baseUrl = rtrim(dirname($this->getScriptUrl()), '\\/');

}

return $this->_baseUrl;

}

/**

* Sets the relative URL for the application.

* By default the URL is determined based on the entry script URL.

* This setter is provided in case you want to change this behavior.

* @param string $value the relative URL for the application

*/

public function setBaseUrl($value)

{

$this->_baseUrl = $value;

}

private $_scriptUrl;

/**

* Returns the relative URL of the entry script.

* The implementation of this method referenced Zend_Controller_Request_Http in Zend Framework.

* @return string the relative URL of the entry script.

* @throws InvalidConfigException if unable to determine the entry script URL

*/

public function getScriptUrl()

{

if ($this->_scriptUrl === null) {

$scriptFile = $this->getScriptFile();

$scriptName = basename($scriptFile);

if (isset($_SERVER['SCRIPT_NAME']) && basename($_SERVER['SCRIPT_NAME']) === $scriptName) {

$this->_scriptUrl = $_SERVER['SCRIPT_NAME'];

} elseif (isset($_SERVER['PHP_SELF']) && basename($_SERVER['PHP_SELF']) === $scriptName) {

$this->_scriptUrl = $_SERVER['PHP_SELF'];

} elseif (isset($_SERVER['ORIG_SCRIPT_NAME']) && basename($_SERVER['ORIG_SCRIPT_NAME']) === $scriptName) {

$this->_scriptUrl = $_SERVER['ORIG_SCRIPT_NAME'];

} elseif (isset($_SERVER['PHP_SELF']) && ($pos = strpos($_SERVER['PHP_SELF'], '/' . $scriptName)) !== false) {

$this->_scriptUrl = substr($_SERVER['SCRIPT_NAME'], 0, $pos) . '/' . $scriptName;

} elseif (!empty($_SERVER['DOCUMENT_ROOT']) && strpos($scriptFile, $_SERVER['DOCUMENT_ROOT']) === 0) {

$this->_scriptUrl = str_replace([$_SERVER['DOCUMENT_ROOT'], '\\'], ['', '/'], $scriptFile);

} else {

throw new InvalidConfigException('Unable to determine the entry script URL.');

}

}

return $this->_scriptUrl;

}

/**

* Sets the relative URL for the application entry script.

* This setter is provided in case the entry script URL cannot be determined

* on certain Web servers.

* @param string $value the relative URL for the application entry script.

*/

public function setScriptUrl($value)

{

$this->_scriptUrl = $value === null ? null : '/' . trim($value, '/');

}

private $_scriptFile;

/**

* Returns the entry script file path.

* The default implementation will simply return `$_SERVER['SCRIPT_FILENAME']`.

* @return string the entry script file path

* @throws InvalidConfigException

*/

public function getScriptFile()

{

if (isset($this->_scriptFile)) {

return $this->_scriptFile;

}

if (isset($_SERVER['SCRIPT_FILENAME'])) {

return $_SERVER['SCRIPT_FILENAME'];

}

throw new InvalidConfigException('Unable to determine the entry script file path.');

}

/**

* Sets the entry script file path.

* The entry script file path normally can be obtained from `$_SERVER['SCRIPT_FILENAME']`.

* If your server configuration does not return the correct value, you may configure

* this property to make it right.

* @param string $value the entry script file path.

*/

public function setScriptFile($value)

{

$this->_scriptFile = $value;

}

private $_pathInfo;

/**

* Returns the path info of the currently requested URL.

* A path info refers to the part that is after the entry script and before the question mark (query string).

* The starting and ending slashes are both removed.

* @return string part of the request URL that is after the entry script and before the question mark.

* Note, the returned path info is already URL-decoded.

* @throws InvalidConfigException if the path info cannot be determined due to unexpected server configuration

*/

public function getPathInfo()

{

if ($this->_pathInfo === null) {

$this->_pathInfo = $this->resolvePathInfo();

}

return $this->_pathInfo;

}

/**

* Sets the path info of the current request.

* This method is mainly provided for testing purpose.

* @param string $value the path info of the current request

*/

public function setPathInfo($value)

{

$this->_pathInfo = $value === null ? null : ltrim($value, '/');

}

/**

* Resolves the path info part of the currently requested URL.

* A path info refers to the part that is after the entry script and before the question mark (query string).

* The starting slashes are both removed (ending slashes will be kept).

* @return string part of the request URL that is after the entry script and before the question mark.

* Note, the returned path info is decoded.

* @throws InvalidConfigException if the path info cannot be determined due to unexpected server configuration

*/

protected function resolvePathInfo()

{

$pathInfo = $this->getUrl();

if (($pos = strpos($pathInfo, '?')) !== false) {

$pathInfo = substr($pathInfo, 0, $pos);

}

$pathInfo = urldecode($pathInfo);

// try to encode in UTF8 if not so

// https://www.w3.org/International/questions/qa-forms-utf-8.en.html

if (

!preg_match('%^(?:

[\x09\x0A\x0D\x20-\x7E] # ASCII

| [\xC2-\xDF][\x80-\xBF] # non-overlong 2-byte

| \xE0[\xA0-\xBF][\x80-\xBF] # excluding overlongs