Index: openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl,v
diff -u -r1.140.2.43 -r1.140.2.44
--- openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	28 May 2016 09:52:18 -0000	1.140.2.43
+++ openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl	30 May 2016 13:07:46 -0000	1.140.2.44
@@ -2659,13 +2659,15 @@
     # In case the "Host:" header field was provided, use the "hostame"
     # and maybe the "port" from there (this has the highest priority)
     #
-    set Host [ns_set iget $headers Host]
+    set Host [security::validated_host_header]
     if {$Host ne ""} {
         if {[util::split_location $Host .proto hostname Host_port]} {
             if {$Host_port ne ""} {
                 set port $Host_port
             }
         }
+    } else {
+        ns_log notice "ignore non-existing or untrusted host header, fall back to <$hostname>"
     }
     
     #