mta-sts.txt working with and without reverse proxy

[monster010]

Contribution Guidelines

• I've read the contribution guidelines and wholeheartedly agree them

What does this PR include?

Short Description

#6998 solves the problem by adding a simple function that takes reverse proxy into account.

Affected Containers

• nginx-mailcow
• php-fpm-mailcow

Did you run tests?

What did you tested?

• Accessing mta-sts.txt with reverse proxy
• Accessing mta-sts.txt without reverse proxy

What were the final results? (Awaited, got)

I expected mta-sts.txt to work both with and without a reverse proxy.

[milkmaker]

Thanks for contributing!

I noticed that you didn't select staging as your base branch. Please change the base branch to staging.
See the attached picture on how to change the base branch to staging:

[milkmaker]

Thanks for contributing!

I noticed that you didn't select staging as your base branch. Please change the base branch to staging.
See the attached picture on how to change the base branch to staging:

[flightlesstux]

Hey, thanks for the work on this — the idea of supporting reverse proxy setups via X-Forwarded-Host is great and definitely needed.

Just spotted a logic bug in the get_requested_host() function that will unfortunately cause the reverse proxy path to never execute:

// Current (buggy) — condition is always false
if(!isset($_SERVER['HTTP_X_FORWARDED_HOST']) && !empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {

!isset and !empty are contradictory here — if the header isn't set, it also can't be non-empty, so this block is unreachable. The !isset should be isset:

// Fixed
if(isset($_SERVER['HTTP_X_FORWARDED_HOST']) && !empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
    $xfh = explode(',', $_SERVER['HTTP_X_FORWARDED_HOST'])[0];
    return trim($xfh);
}

Once that's flipped, the logic works as intended — falls back to HTTP_HOST when the forwarded header isn't present, and uses the first value from the comma-separated list when it is.

One small note on security: trusting X-Forwarded-Host directly is fine here since this is only used to check the mta-sts. prefix and look up a domain that's already validated against the database downstream — no injection risk.

Great fix overall, just needs that one-character change!

[monster010]

@flightlesstux Thanks for the heads-up, I must have somehow overlooked that.
Fixed.