Remove production check for hosts (bigbluebutton#1549)

henriquebol · May 8, 2020 · 6b628d6 · 6b628d6
1 parent 6104b3d
commit 6b628d6
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
@@ -47,9 +47,8 @@ def bbb_server
 
   # Block unknown hosts to mitigate host header injection attacks
   def block_unknown_hosts
-    return unless Rails.env.production?
-    return if config.hosts.blank?
-    raise UnsafeHostError, "#{request.host} is not a safe host" unless config.hosts.include?(request.host)
+    return if Rails.configuration.hosts.blank?
+    raise UnsafeHostError, "#{request.host} is not a safe host" unless Rails.configuration.hosts.include?(request.host)
   end
 
   # Force SSL