Security vulnerabilities fix

[rhowinespinoza]

Fixes:

1. Fix incorrect end tag
2. Fix infinite request loop
3. Use SERVER_NAME instead of HTTP_HOST to prevent SSRF attack

[kornicameister]

It's been 2 years already so asking if there's a plan to get this merged is rather awkward.
I will though ask @rhowinespinoza ; are you able to point out what needed to happen for 2nd point to occur?

[rhowinespinoza]

It's been 2 years already so asking if there's a plan to get this merged is rather awkward. I will though ask @rhowinespinoza ; are you able to point out what needed to happen for 2nd point to occur?

@kornicameister An HTTP GET request to /js/whichbrowser/?a will cause the server to continuously send HTTP GET requests to itself because the detect url will be /js/whichbrowser/?adetect.php.

[kornicameister]

I know... :D

[kornicameister]

@rhowinespinoza were you able to battle test your solution? Is it a script, test somewhere that you used to find and confirm the fix? I mean, I would like to have it used to verify things on my end but given I am not exactly on friendly terms with PHP (although maybe I don't need to), any help would be appreciated.

[kornicameister]

oh, lovely :* thanks @NielsLeenheer