CVE-2026-43935

@@ -52,5 +52,4 @@
 define("LAN_FPW_100", "Forgot your password?");
 define("LAN_FPW_101", "Not to worry. Just enter your email address below and we'll send you an email with instructions to get it back.");
 define("LAN_FPW_102", "Reset Password");
-
-
+define("LAN_FPW_MISCONFIGURED", "Password reset is currently unavailable due to a site configuration issue. Please contact the site administrator.");

@@ -83,6 +83,13 @@ function fpw_error($txt)
 	exit;
 }
 
+$fpw_siteurl = e107::getPref('siteurl');
+if (empty($fpw_siteurl))
+{
+	error_log('fpw.php: Password reset blocked because the "siteurl" preference is not set. Configure it in Admin → Preferences.');
+	fpw_error(LAN_FPW_MISCONFIGURED);
+}
+
 //the separator character used
 define('FPW_SEPARATOR', '#');
 //$fpw_sep = '#';
@@ -256,7 +263,7 @@ function fpw_error($txt)
 	//	$rcode 		= crypt(($_SERVER['HTTP_USER_AGENT'] . serialize($pref). $clean_email . $datekey), e_TOKEN);
 
 		// Prepare email
-		$link 		= SITEURL.'fpw.php?'.$rcode;
+		$link 		= rtrim($fpw_siteurl, '/').'/fpw.php?'.$rcode;
 		$message 	= LAN_FPW5.' '.SITENAME.' '.LAN_FPW14.': '.e107::getIPHandler()->getIP(TRUE).".\n\n".LAN_FPW15."\n\n".LAN_FPW16."\n\n".LAN_FPW17."\n\n{$link}";
 
 		// Set timestamp two days ahead so it doesn't get auto-deleted

@@ -5525,13 +5525,14 @@ public function inAdminDir($e107Path, $curPage, $isPluginDir)
 	public function set_urls_deferred()
 	{
 		$siteurl = self::getPref('siteurl');
+		$configured_host = parse_url($siteurl, PHP_URL_HOST);
 
 		if(self::isCli())
 		{
 			define('SITEURL', $siteurl);
 			define('SITEURLBASE', rtrim(SITEURL,'/'));
 		}
-		elseif(strpos($siteurl,'http')!== false && strpos($siteurl, $_SERVER['HTTP_HOST'])===false)
+		elseif(!empty($configured_host) && strpos($siteurl,'http')!== false && $configured_host !== $_SERVER['HTTP_HOST'] && substr($_SERVER['HTTP_HOST'], - strlen('.' . $configured_host)) !== ('.' . $configured_host))
 		{
 			die('Site Configuration Issue Detected. Please contact your webmaster.');
 			error_log('The configured siteurl in your preferences does not match the HTTP_HOST: '.$_SERVER['HTTP_HOST']);

@@ -362,7 +362,7 @@ function sendTest()
 						<td><label for='siteurl'>".PRFLAN_3."</label>
 						".($pref['siteurl'] == SITEURL ? "" : $frm->help(PRFLAN_159.": <strong>".SITEURL."</strong>"))."</td>
 						<td>
-							".$frm->text('siteurl', $pref['siteurl'], 150, 'size=xxlarge')."
+							".$frm->text('siteurl', $pref['siteurl'], 150, ['size'=>'xxlarge', 'required'=>1, 'pattern' => '^http.*', 'placeholder'=>'eg. '.SITEURL])."
 						</td>
 					</tr>
 					<tr>

@@ -5524,11 +5524,18 @@ public function inAdminDir($e107Path, $curPage, $isPluginDir)
 	 */
 	public function set_urls_deferred()
 	{
+		$siteurl = self::getPref('siteurl');
+
 		if(self::isCli())
 		{
-			define('SITEURL', self::getPref('siteurl'));
+			define('SITEURL', $siteurl);
 			define('SITEURLBASE', rtrim(SITEURL,'/'));
 		}
+		elseif(strpos($siteurl,'http')!== false && strpos($siteurl, $_SERVER['HTTP_HOST'])===false)
+		{
+			die('Site Configuration Issue Detected. Please contact your webmaster.');
+			error_log('The configured siteurl in your preferences does not match the HTTP_HOST: '.$_SERVER['HTTP_HOST']);
+		}
 		else
 		{
 			define('SITEURLBASE', $this->HTTP_SCHEME.'://'. filter_var($_SERVER['HTTP_HOST'], FILTER_SANITIZE_URL));