From 2a57e44302b89382f44766e4f077740f8bf293e2 Mon Sep 17 00:00:00 2001
From: Henry Jonas <jonathan.quispe@processmaker.com>
Date: Fri, 3 Jul 2026 16:06:44 -0400
Subject: [PATCH 1/2] FOUR-32101: Northleaf Private prod - route and events
 cache revision

---
 ProcessMaker/Http/Middleware/TrustHosts.php | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/ProcessMaker/Http/Middleware/TrustHosts.php b/ProcessMaker/Http/Middleware/TrustHosts.php
index 68330a6e89..98a14cafad 100644
--- a/ProcessMaker/Http/Middleware/TrustHosts.php
+++ b/ProcessMaker/Http/Middleware/TrustHosts.php
@@ -10,8 +10,21 @@ class TrustHosts extends Middleware
 {
     public function hosts(): array
     {
-        $trustedHost = $this->allSubdomainsOfApplicationUrl();
-        return [$trustedHost];
+        $hosts = array_filter([
+            $this->allSubdomainsOfApplicationUrl(),
+        ]);
+
+        $trustedHostsEnv = env('TRUSTED_HOSTS_LINKS', '');
+        if ($trustedHostsEnv !== '') {
+            foreach (array_filter(array_map('trim', explode(',', $trustedHostsEnv))) as $host) {
+                if (str_contains($host, '://')) {
+                    $host = parse_url($host, PHP_URL_HOST) ?: $host;
+                }
+                $hosts[] = '^(.+\.)?' . preg_quote($host) . '$';
+            }
+        }
+
+        return array_values($hosts);
     }
 
     public function handle(Request $request, $next)

From f90ef5a52ff41b3cdd8fb9cd2068eafa32db4f98 Mon Sep 17 00:00:00 2001
From: Henry Jonas <jonathan.quispe@processmaker.com>
Date: Mon, 6 Jul 2026 16:07:49 -0400
Subject: [PATCH 2/2] FOUR-32101: Northleaf Private prod - route and events
 cache revision, update notes

---
 ProcessMaker/Http/Middleware/TrustHosts.php | 2 +-
 config/app.php                              | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/ProcessMaker/Http/Middleware/TrustHosts.php b/ProcessMaker/Http/Middleware/TrustHosts.php
index 98a14cafad..05d3539a8a 100644
--- a/ProcessMaker/Http/Middleware/TrustHosts.php
+++ b/ProcessMaker/Http/Middleware/TrustHosts.php
@@ -14,7 +14,7 @@ public function hosts(): array
             $this->allSubdomainsOfApplicationUrl(),
         ]);
 
-        $trustedHostsEnv = env('TRUSTED_HOSTS_LINKS', '');
+        $trustedHostsEnv = config('app.trusted_hosts_links', '');
         if ($trustedHostsEnv !== '') {
             foreach (array_filter(array_map('trim', explode(',', $trustedHostsEnv))) as $host) {
                 if (str_contains($host, '://')) {
diff --git a/config/app.php b/config/app.php
index ea6d3bbfb5..dbf57886bd 100644
--- a/config/app.php
+++ b/config/app.php
@@ -11,6 +11,9 @@
     // The url of our host, will usually be set during installation
     'url' => env('APP_URL', 'http://localhost'),
 
+    // Comma-separated list of additional trusted hosts (e.g. https://www.google.com)
+    'trusted_hosts_links' => env('TRUSTED_HOSTS_LINKS', ''),
+
     // The application key to be used for hashing secrets
     'key' => env('APP_KEY', 'base64:x80I9vQNxwllSuwBkTwfUa5qkgPTRdwqHCPSz7zHi1U='),