Reflected XSS Vulnerability on rss.php

[frostb1ten]

Fix for a Reflected XSS vulnerability. Attackers can add the X-Forwarded-Host header to inject XSS payloads.

X-Forwarded-Host: <script>alert(document.cookie)</script>

This mitigation prevents X-Forwarded-Host from being modified.

[kaltura-hooks]

Hi @frostb1ten,
Thank you for contributing this pull request!
Please sign the Kaltura CLA so we can review and merge your contribution.
Learn more at http://bit.ly/KalturaContrib

[frostb1ten]

CLA completed. Thank you!

[frostb1ten]

$baseUrl later on is displayed back at:

<link><?php echo $baseUrl ?></link>

Changing to SERVER_NAME prevents attackers from modifying the host via x-forwarded-host.