mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-12 15:53:46 -04:00
Andras Bacsai
b31c06a7eb
When no instance domain is set, invitation links were built from the request host, which a client can spoof through a forwarded Host header. Links now always use base_url(). The fallback test now forces a spoofed root URL and checks that the link ignores it.