phpwcms v1.9.53

Security release for the legacy 1.9 line (PHP 7.4).

🔒 Security

• Host header poisoning of mailed links (GHSA-x5fx-f274-39p8): X-Forwarded-Host is believed only when the request comes from a trusted_proxies entry, the resulting host is validated and the new $phpwcms['trusted_hosts'] allowlist is honoured. Every mailer that embeds an absolute link — password reminder, form double opt-in, newsletter verification, guestbook notification, e-card, profile notifications, feed import status, backend newsletter send — uses phpwcms_mail_site_url() and skips the mail when the site URL came from an unverified request host. The setup wizard stores the detected URL in site when the field is left empty.
• Local file disclosure via form attachments (GHSA-9mvh-hxj5-9fgg): only a field declared as upload may carry folder, name and attachment metadata, and the resolved file must pass realpath() containment inside PHPWCMS_ROOT. Array POST values keep their values but never their keys; the same gate protects the error-path file deletion.
• Inline download of uploaded files (GHSA-rmf4-vf3j-hq8g): inline rendering is limited to an extension allowlist (raster images, PDF, plain text/CSV, audio and video), everything else is delivered as attachment. The stored MIME type, client controlled at upload, no longer decides the disposition — dl_file_resume() re-detects with fileinfo and downgrades to attachment when the type can execute scripts. download.php?file= ignores ?type= for inline responses and both delivery paths send X-Content-Type-Options: nosniff.

Database revision stays at r554; no migrations. Requires PHP 7.4+.