Merge branch '5935-fatal-error-due-to-crsf-security' into '1.4-dev'

Resolve "Fatal error due to CRSF security"

See merge request fusiondirectory/fd!475

(cherry picked from commit 555e9489)

597d64c9  fix(CSRFProtection) Split HTTP_X_FORWARDED_HOST to take only the first value

include/class_CSRFProtection.inc

@@ -56,7 +56,8 @@ class CSRFProtection
       $origin = preg_replace('|^[^/]+://([^/]+)(/.*)?$|', '\1', $origin);
       $target = FALSE;
       if (!empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
-        $target = $_SERVER['HTTP_X_FORWARDED_HOST'];
+        /* Only take the first value, there may be several separated by commas */
+        list($target) = explode(',', $_SERVER['HTTP_X_FORWARDED_HOST'], 2);
       } else
       if (!empty($_SERVER['HTTP_HOST'])) {
         $target = $_SERVER['HTTP_HOST'];