fix(sub): never use X-Real-IP as the subscription host (#6608)

ResolveRequest and the panel's resolveHost fell back to X-Real-IP for the host when a trusted proxy sent no X-Forwarded-Host. X-Real-IP names the visitor, so behind nginx with only that header set, subscription and exported links advertised the subscriber's own public IP as the server.

The host now comes from a trusted X-Forwarded-Host, else the dialed request Host. X-Real-IP stays a client-IP source only.

Fixes #6589.

internal/web/controller/util_test.go

@@ -32,3 +32,30 @@ func TestGetRemoteIpHonorsForwardedHeadersFromTrustedLoopbackProxy(t *testing.T)
 		t.Fatalf("remote IP = %q, want forwarded client IP", got)
 	}
 }
+
+func TestResolveHostPrefersForwardedHostOverRealIP(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	c.Request.Host = "panel.example.com:2053"
+	c.Request.RemoteAddr = "127.0.0.1:12345"
+	c.Request.Header.Set("X-Forwarded-Host", "sub.example.net:443")
+	c.Request.Header.Set("X-Real-IP", "198.51.100.7")
+
+	if got := resolveHost(c); got != "sub.example.net" {
+		t.Fatalf("resolveHost = %q, want X-Forwarded-Host", got)
+	}
+}
+
+func TestResolveHostIgnoresRealIPFromTrustedProxy(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
+	c.Request.Host = "panel.example.com:2053"
+	c.Request.RemoteAddr = "127.0.0.1:12345"
+	c.Request.Header.Set("X-Real-IP", "198.51.100.7")
+
+	if got := resolveHost(c); got != "panel.example.com" {
+		t.Fatalf("resolveHost = %q, want request host (not X-Real-IP)", got)
+	}
+}