From 760ec301e3696e7de28c784aa875a685464a8baa Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sat, 28 Jan 2023 17:22:52 +0100
Subject: [PATCH] harden the trusted hosts

---
 webmails/roundcube/config/config.inc.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/webmails/roundcube/config/config.inc.php b/webmails/roundcube/config/config.inc.php
index 72db545c..3ced13e7 100644
--- a/webmails/roundcube/config/config.inc.php
+++ b/webmails/roundcube/config/config.inc.php
@@ -15,6 +15,7 @@ $config['enable_spellcheck'] = true;
 $config['spellcheck_engine'] = 'pspell';
 $config['session_lifetime'] = {{ SESSION_TIMEOUT_MINUTES | int }};
 $config['request_path'] = '{{ WEB_WEBMAIL or "none" }}';
+$config['trusted_host_patterns'] = [ {{ HOSTNAMES.split(",") | map("tojson") | join(',') }}];
 
 // Mail servers
 $config['imap_host'] = '{{ FRONT_ADDRESS or "front" }}:10143';