Merge branch 'master' into mcp

.env

@@ -8,6 +8,7 @@ APP_SECRET=a03498528f5a5fc089273ec9ae5b2849
 # Change this and uncomment the following line to set the trusted hosts for your Part-DB installation, aka under which
 # domain names it is reachable. This is makes things more secure, because it can prevent certain header attacks.
 # You have to escape dots in the domain name with a backslash
+# IMPORTANT: In .env files (like this one), the value must be wrapped in single quotes as shown below.
 #TRUSTED_HOSTS='^(your-domain\.invalid)$'
 
 # You can also allow multiple domain names, e.g. for testing or development purposes, with an | between the domain names.

VERSION

@@ -1 +1 @@
-2.13.3
+2.13.4

docs/configuration.md

@@ -265,10 +265,16 @@ See the [information providers]({% link usage/information_provider_system.md %})
   should be accessible. If accessed via a hostname not matching the regex, an error page will be shown instead. By default this
   is empty, meaning Part-DB accepts requests for any host name, which is not recommended for production use.
 
-  For example, if Part-DB should only be reachable under `part-db.example.invalid`, set:
+  For example, if Part-DB should only be reachable under `part-db.example.invalid`, set the following in your
+  `.env.local` file (the value must be wrapped in single quotes here):
   ```
   TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
   ```
+  If you set `TRUSTED_HOSTS` as an environment variable in your `docker-compose.yaml` instead, the value must
+  **not** be quoted:
+  ```
+  TRUSTED_HOSTS=^(part-db\.example\.invalid)$
+  ```
   You can specify multiple host names separated by `|`, e.g. `^(localhost|part-db\.example\.invalid)$`.
   Part-DB displays a warning on the homepage (visible to administrators only) as long as this value is not set.
 * `DEMO_MODE` (env only): Set Part-DB into demo mode, which forbids users to change their passwords and settings. Used for the demo

docs/installation/installation_docker.md

@@ -87,6 +87,7 @@ services:
 
       # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
       # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
+      # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
       # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
 
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:
@@ -101,7 +102,8 @@ services:
 openssl rand -hex 32
 ```
 6. Uncomment and set the `TRUSTED_HOSTS` variable to a regex matching the host name(s) Part-DB should be reachable under
-   (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. See [Configuration]({% link configuration.md %})
+   (e.g. `^(part-db\.example\.invalid)$`), to prevent HTTP Host header attacks. Note that, unlike in `.env` files, the
+   value must **not** be quoted in `docker-compose.yaml`. See [Configuration]({% link configuration.md %})
    for more information.
 7. Inside the folder, run
 
@@ -181,6 +183,7 @@ services:
 
       # To prevent HTTP Host header attacks, set this to a regex matching all host names Part-DB should be reachable under.
       # By default (unset) Part-DB accepts requests for any host name, which is not recommended for production use.
+      # IMPORTANT: Unlike in .env files, the value here must NOT be wrapped in quotes.
       # - TRUSTED_HOSTS=^(part-db\.example\.invalid)$
 
       # If you need to install additional composer packages (e.g., for specific mailer transports), you can specify them here:

docs/installation/reverse-proxy.md

@@ -24,12 +24,18 @@ the reverse proxy).
 
 You should also set the `TRUSTED_HOSTS` environment variable to a regex matching the host name(s) Part-DB is reachable
 under via the reverse proxy, to prevent `HTTP Host header attacks`. For example, if Part-DB is reachable via
-`part-db.example.invalid`, set:
+`part-db.example.invalid`, set the following in your `.env.local` file (the value must be wrapped in single quotes here):
 
 ```
 TRUSTED_HOSTS='^(part-db\.example\.invalid)$'
 ```
 
+If you set `TRUSTED_HOSTS` in your `docker-compose.yaml` instead, the value must **not** be quoted:
+
+```
+TRUSTED_HOSTS=^(part-db\.example\.invalid)$
+```
+
 See the [configuration options](../configuration.md) page for more information about `TRUSTED_HOSTS`.
 
 ## Part-DB in a subpath via reverse proxy

templates/bundles/TwigBundle/Exception/error400.html.twig

@@ -23,12 +23,16 @@
         <p>Try following things:</p>
         <ul>
             <li>Ensure that you are using the correct URL to access Part-DB.</li>
-            <li>Set the <code>TRUSTED_HOSTS</code> environment variable in your <code>.env.local</code> file (or your docker-compose environment) to a regular expression matching all host names Part-DB should be reachable under, e.g.
+            <li>Set the <code>TRUSTED_HOSTS</code> environment variable to a regular expression matching all host names Part-DB should be reachable under. Note that the required quoting differs depending on where you set it:
-                {% if seen_host %}
+                <ul>
-                    <code>TRUSTED_HOSTS='^({{ seen_host|replace({'.': '\\.'}) }})$'</code> (if <code>{{ seen_host }}</code> is a host name you trust)
+                    {% if seen_host %}
-                {% else %}
+                        <li>In your <code>.env.local</code> file, the value must be wrapped in single quotes: <code>TRUSTED_HOSTS='^({{ seen_host|replace({'.': '\\.'}) }})$'</code> (if <code>{{ seen_host }}</code> is a host name you trust)</li>
-                    <code>TRUSTED_HOSTS='^(localhost|example\.com)$'</code>
+                        <li>In <code>docker-compose.yaml</code>, the value must NOT be quoted: <code>TRUSTED_HOSTS=^({{ seen_host|replace({'.': '\\.'}) }})$</code> (if <code>{{ seen_host }}</code> is a host name you trust)</li>
-                {% endif %}
+                    {% else %}
+                        <li>In your <code>.env.local</code> file, the value must be wrapped in single quotes: <code>TRUSTED_HOSTS='^(localhost|example\.com)$'</code></li>
+                        <li>In <code>docker-compose.yaml</code>, the value must NOT be quoted: <code>TRUSTED_HOSTS=^(localhost|example\.com)$</code></li>
+                    {% endif %}
+                </ul>
             </li>
             <li>If Part-DB is running behind a reverse proxy, also make sure that <code>TRUSTED_PROXIES</code> is configured correctly, so the original host name is forwarded properly.</li>
             <li>Run <kbd>php bin/console cache:clear</kbd> after changing the configuration.</li>

templates/homepage.html.twig

@@ -98,9 +98,12 @@
     {% if trusted_hosts_unconfigured and is_granted('@system.server_infos') %}
         <div class="alert alert-warning" role="alert">
             <h5><i class="fa-solid fa-triangle-exclamation fa-fw"></i> {% trans %}system.trusted_hosts.unconfigured.title{% endtrans %}</h5>
-            <p class="mb-1">{% trans %}system.trusted_hosts.unconfigured.message{% endtrans %}</p>
+            <p class="mb-1">{% trans %}system.trusted_hosts.unconfigured.message{% endtrans %}
-            <p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.suggestion{% endtrans %}
+                {% trans %}system.trusted_hosts.unconfigured.suggestion{% endtrans %}</p>
-                <br><code>TRUSTED_HOSTS='^({{ app.request.host|replace({'.': '\\.'}) }})$'</code></p>
+            <p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.env_example{% endtrans %}
+                <code>TRUSTED_HOSTS='^({{ app.request.host|replace({'.': '\\.'}) }})$'</code></p>
+            <p class="mb-0">{% trans %}system.trusted_hosts.unconfigured.docker_example{% endtrans %}
+                <code>TRUSTED_HOSTS=^({{ app.request.host|replace({'.': '\\.'}) }})$</code></p>
             <small>{% trans %}update_manager.new_version_available.only_administrators_can_see{% endtrans %}</small>
         </div>
     {% endif %}

translations/messages.de.xlf

@@ -13728,7 +13728,19 @@ Buerklin-API-Authentication-Server:
     <unit id="qZ_kgWT" name="system.trusted_hosts.unconfigured.suggestion">
       <segment state="translated">
         <source>system.trusted_hosts.unconfigured.suggestion</source>
-        <target>Legen Sie einen regulären Ausdruck fest, der alle Hostnamen abdeckt, unter denen Part-DB erreichbar sein soll, z. B. basierend auf dem Hostnamen, den Sie für den Zugriff auf diese Seite verwendet haben. Dies ist möglich in Ihrer Datei &lt;code&gt;.env.local&lt;/code&gt; oder &lt;code&gt;docker-compose.yaml&lt;/code&gt;:</target>
+        <target>Legen Sie einen regulären Ausdruck fest, der alle Hostnamen abdeckt, unter denen Part-DB erreichbar sein soll, z. B. basierend auf dem Hostnamen, den Sie für den Zugriff auf diese Seite verwendet haben. Beachten Sie, dass die erforderliche Anführungszeichen-Schreibweise davon abhängt, wo Sie den Wert setzen:</target>
+      </segment>
+    </unit>
+    <unit id="ie4thSr" name="system.trusted_hosts.unconfigured.env_example">
+      <segment state="translated">
+        <source>system.trusted_hosts.unconfigured.env_example</source>
+        <target>In Ihrer Datei &lt;code&gt;.env.local&lt;/code&gt; muss der Wert in einfache Anführungszeichen eingeschlossen werden:</target>
+      </segment>
+    </unit>
+    <unit id="ni3hSTN" name="system.trusted_hosts.unconfigured.docker_example">
+      <segment state="translated">
+        <source>system.trusted_hosts.unconfigured.docker_example</source>
+        <target>In &lt;code&gt;docker-compose.yaml&lt;/code&gt; darf der Wert NICHT in Anführungszeichen stehen:</target>
       </segment>
     </unit>
     <unit id="cEwxoSj" name="info_providers.provider_key">

translations/messages.en.xlf

@@ -13730,7 +13730,19 @@ Buerklin-API Authentication server:
     <unit id="qZ_kgWT" name="system.trusted_hosts.unconfigured.suggestion">
       <segment state="translated">
         <source>system.trusted_hosts.unconfigured.suggestion</source>
-        <target>Set it to a regular expression matching all host names Part-DB should be reachable under in your &lt;code&gt;.env.local&lt;/code&gt; or &lt;code&gt;docker-compose.yaml&lt;/code&gt; file, e.g. based on the host name you used to access this page:</target>
+        <target>Set it to a regular expression matching all host names Part-DB should be reachable under, e.g. based on the host name you used to access this page. Note that the required quoting differs depending on where you set it:</target>
+      </segment>
+    </unit>
+    <unit id="ie4thSr" name="system.trusted_hosts.unconfigured.env_example">
+      <segment state="translated">
+        <source>system.trusted_hosts.unconfigured.env_example</source>
+        <target>In your &lt;code&gt;.env.local&lt;/code&gt; file, the value must be wrapped in single quotes:</target>
+      </segment>
+    </unit>
+    <unit id="ni3hSTN" name="system.trusted_hosts.unconfigured.docker_example">
+      <segment state="translated">
+        <source>system.trusted_hosts.unconfigured.docker_example</source>
+        <target>In &lt;code&gt;docker-compose.yaml&lt;/code&gt;, the value must NOT be quoted:</target>
       </segment>
     </unit>
     <unit id="cEwxoSj" name="info_providers.provider_key">