From 14560037fe9495b3c620b10423f94c9dbd7d4b86 Mon Sep 17 00:00:00 2001
From: Rhowin Espinoza <rhowin.espinoza@smartpaymentplan.com>
Date: Thu, 15 Oct 2020 19:39:47 +0800
Subject: [PATCH 1/3] Fix incorrect end tag

---
 index.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/index.php b/index.php
index 1a8fec1..e20b867 100644
--- a/index.php
+++ b/index.php
@@ -151,7 +151,7 @@
 				After the script has been loaded, you need to create a new WhichBrowser object, which you can query for details about the browser that is currently being used:
 			</p>
 			
-			<div id='example'></pre>
+			<div id='example'></div>
 
 			<script>
 	

From bb9a27f6593997e712cbaa0ad39209a0037a5110 Mon Sep 17 00:00:00 2001
From: Rhowin Espinoza <rhowin.espinoza@smartpaymentplan.com>
Date: Thu, 15 Oct 2020 19:43:15 +0800
Subject: [PATCH 2/3] =?UTF-8?q?Use=20SERVER=5FNAME=20instead=20of=20HTTP?=
 =?UTF-8?q?=5FHOST=20to=20prevent=20SSRF=20attack.=20HTTP=5FHOST=20is=20co?=
 =?UTF-8?q?ntrollable=20by=20the=20user=20and=20isn=E2=80=99t=20required?=
 =?UTF-8?q?=20to=20match=20the=20requested=20server.=20The=20attacker=20on?=
 =?UTF-8?q?ly=20needs=20to=20set=20the=20HTTP=20Host=20header=20to=20cause?=
 =?UTF-8?q?=20the=20server=20to=20attempt=20a=20GET=20request=20connect=20?=
 =?UTF-8?q?to=20any=20server,=20including=20internal=20networks.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 index.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/index.php b/index.php
index e20b867..3c89e0d 100644
--- a/index.php
+++ b/index.php
@@ -122,10 +122,10 @@
 			else {
 				$base = preg_replace('/index.php.*/', '', $_SERVER['REQUEST_URI']); 
 
-				$result = file_get_contents(($_SERVER['HTTPS'] ? 'https://' : 'http://') . $_SERVER['HTTP_HOST'] . $base . 'detect.php');
+				$result = file_get_contents(($_SERVER['HTTPS'] ? 'https://' : 'http://') . $_SERVER['SERVER_NAME'] . $base . 'detect.php');
 				if ($result) $working = preg_match('/WhichBrowser/', $result);
 
-				$result = file_get_contents(($_SERVER['HTTPS'] ? 'https://' : 'http://') . $_SERVER['HTTP_HOST'] . $base . 'detect.js');
+				$result = file_get_contents(($_SERVER['HTTPS'] ? 'https://' : 'http://') . $_SERVER['SERVER_NAME'] . $base . 'detect.js');
 				if ($result) $redirect = preg_match('/WhichBrowser/', $result);
 			}
 		?>
@@ -144,7 +144,7 @@
     e|=(e&16&&({}.toString).toString().indexOf("\n")===-1)?32:0;p.push('e='+e);f|='sandbox' in d.createElement('iframe')?1:0;f|='WebSocket' in w?2:0;
     f|=w.Worker?4:0;f|=w.applicationCache?8:0;f|=w.history && history.pushState?16:0;f|=d.documentElement.webkitRequestFullScreen?32:0;f|='FileReader' in w?64:0;
     p.push('f='+f);p.push('r='+Math.random().toString(36).substring(7));p.push('w='+screen.width);p.push('h='+screen.height);var s=d.createElement('script');
-    s.src='//<?php echo $_SERVER['HTTP_HOST'];?><?php echo $local ? '' : '/whichbrowser'; ?>/detect.<?php echo $redirect ? 'js' : 'php'; ?>?' + p.join('&');d.getElementsByTagName('head')[0].appendChild(s);})();
+    s.src='//<?php echo $_SERVER['SERVER_NAME'];?><?php echo $local ? '' : '/whichbrowser'; ?>/detect.<?php echo $redirect ? 'js' : 'php'; ?>?' + p.join('&');d.getElementsByTagName('head')[0].appendChild(s);})();
 &lt;/script&gt;</pre>
 			
 			<p>

From d8976d2b884798bea4ebb474cc558b93562e4765 Mon Sep 17 00:00:00 2001
From: Rhowin Espinoza <rhowin.espinoza@smartpaymentplan.com>
Date: Thu, 15 Oct 2020 19:46:40 +0800
Subject: [PATCH 3/3] Fix infinite request loop. An HTTP GET request to
 /js/whichbrowser/?a will cause the server to continuously send HTTP GET
 requests to itself because the detect url will be
 /js/whichbrowser/?adetect.php.

---
 index.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/index.php b/index.php
index 3c89e0d..d37f5be 100644
--- a/index.php
+++ b/index.php
@@ -120,7 +120,8 @@
 				$local = true;
 			} 
 			else {
-				$base = preg_replace('/index.php.*/', '', $_SERVER['REQUEST_URI']); 
+                $raw_base = explode('?', $_SERVER['REQUEST_URI']);
+                $base = preg_replace('/index.php.*/', '', $raw_base[0]);
 
 				$result = file_get_contents(($_SERVER['HTTPS'] ? 'https://' : 'http://') . $_SERVER['SERVER_NAME'] . $base . 'detect.php');
 				if ($result) $working = preg_match('/WhichBrowser/', $result);