fixed Host header vulnerability #1196

applications/welcome/models/db.py

@@ -58,7 +58,8 @@ response.form_label_separator = myconf.get('forms.separator') or ''
 
 from gluon.tools import Auth, Service, PluginManager
 
-auth = Auth(db, host=myconf.get('host.name'))
+# host names must be a list of allowed host names (glob syntax allowed)
+auth = Auth(db, host_names=myconf.get('host.names'))
 service = Service()
 plugins = PluginManager()