In a Drupal installation, which is served through the web server's default server config (i.e. it gets any request for an otherwise unknown domain) I have a settings file at DRUPAL_ROOT/sites/example.com.au/settings.php
.
This site is normally requested as http://example.com.au/
, but what's given that the request gets to the server (and the user agent may not follow the directives of DNS here), what's to prevent it being served as a response for http://example.com/au/
or http://example/com/au/
?
The testing I've done suggests something blocks this from working (I get a redirect to the install page), but I want to be clear on what's going on, and to be sure that it's reliable.
If accessing a drupal installation through divisions of the domain name and path other than the expected one is possible, then there would be security implications.
EDIT:
In response to @tenken:
From https://api.drupal.org/api/drupal/sites!example.sites.php/7
This file allows you to define a set of aliases that map hostnames, ports, and pathnames to configuration directories in the sites directory. These aliases are loaded prior to scanning for directories, and they are exempt from the normal discovery rules. See default.settings.php to view how Drupal discovers the configuration directory when no alias is found.
It's not perfectly clear, but that sounds like the directory in the sites file will will still be used if a request arrives with a domain name that was not anticipated, in which case the problem remains.