Ticket #6880: 6880_patch.diff

django/http/__init__.py

@@ -45 +45 @@
     def get_host(self):
         """Returns the HTTP host using the environment or request headers."""
         # We try three options, in order of decreasing preference.
-        if 'HTTP_X_FORWARDED_HOST' in self.META:
+        if settings.USE_X_FORWARDED_HOST and 'HTTP_X_FORWARDED_HOST' in self.META:
             host = self.META['HTTP_X_FORWARDED_HOST']
         elif 'HTTP_HOST' in self.META:
             host = self.META['HTTP_HOST']

django/conf/global_settings.py

@@ -20 +20 @@
 # Whether to use the "Etag" header. This saves bandwidth but slows down performance.
 USE_ETAGS = False
 
+# Whether to use the "HTTP_X_FORWARDED_HOST" header as the hostname. Useful for some
+# virtual hosting situations.
+USE_X_FORWARDED_HOST = False
+
 # People who get code error notifications.
 # In the format (('Full Name', 'email@domain.com'), ('Full Name', 'anotheremail@domain.com'))
 ADMINS = ()

docs/ref/request-response.txt

@@ -184 +184 @@
 
    .. versionadded:: 1.0
 
-   Returns the originating host of the request using information from the
-   ``HTTP_X_FORWARDED_HOST`` and ``HTTP_HOST`` headers (in that order). If
-   they don't provide a value, the method uses a combination of
-   ``SERVER_NAME`` and ``SERVER_PORT`` as detailed in `PEP 333`_.
+   Returns the host of the request. If :setting:`USE_X_FORWARDED_HOST` is
+   set to ``True``, the host provided in the ``HTTP_X_FORWARDED_HOST`` 
+   header will be used, otherwise the host in the ``HTTP_HOST`` header is
+   used. If neither header provides a value, the method uses a combination 
+   of ``SERVER_NAME`` and ``SERVER_PORT`` as detailed in `PEP 333`_.
 
    .. _PEP 333: http://www.python.org/dev/peps/pep-0333/
 

docs/ref/settings.txt

@@ -1203 +1203 @@
 
 .. setting:: YEAR_MONTH_FORMAT
 
+USE_X_FORWARDED_HOST
+--------------------
+
+Default: ``False``
+
+A boolean that specifies whether to use the ``HTTP_X_FORWARDED_HOST`` header as 
+the hostname when generating absolute URLs from relative URLs. This can be 
+useful for some virtual hosting configurations.
+
 YEAR_MONTH_FORMAT
 -----------------