Remove the option to specify a base_url from within settings.php

Created on 8 July 2015, over 9 years ago
Updated 7 March 2025, 2 days ago

Problem/Motivation

Currently it is possible to enforce a $base_url from within settings.php. Up until Drupal 4.6.x this was required. Since then it was only necessary on broken webserver configurations. Also depending on the webserver configuration, setting $base_url was required in order to prevent instances of #2221699: HTTP_HOST header cannot be trusted (e.g., possibly #1355344: Possible to deface using HTTP_HOST if base_url not set in settings.php ), but that issue has been resolved by introducing the trusted_host_patterns setting.

However, since there is no way to enforce the base URL in a Symfony request, the setting only works for code which is still depending on the deprecated globals. E.g., on a site which enforces $base_url from settings.php, modern code using something like $request->getSchemeAndHttpHost() will produce the wrong results in such configurations.

Note that enforcing $base_url in settings.php also influences $base_root and $base_path globals.

All of this functionality not covered at all by any tests.

Proposed resolution

Remove the option to specify a base_url from within settings.php.

Remaining tasks

Review.

User interface changes

None.

API changes

None.

Data model changes

None.

Beta phase evaluation

<!--Uncomment the relevant rows for the issue. -->
🐛 Bug report
Status

Fixed

Version

8.1 ⚰️

Component

base system

Created by

🇨🇭Switzerland znerol

Live updates comments and jobs are added and updated live.
  • Quick fix

    Very small and simple change. Preferred over Quickfix.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024