Close #3292

2 files changed, 2 insertions, 1 deletions

diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst
index f57e244b1..909c3bc3c 100644
--- a/user_guide_src/source/changelog.rst
+++ b/user_guide_src/source/changelog.rst
@@ -503,6 +503,7 @@ Release Date: Not Released
       -  Removed internal method ``_assign_to_config()`` and moved its implementation to *CodeIgniter.php* instead.
       -  ``item()`` now returns NULL instead of FALSE when the required config item doesn't exist.
       -  Added an optional second parameter to both ``base_url()`` and ``site_url()`` that allows enforcing of a protocol different than the one in the *base_url* configuration setting.
+      -  Added HTTP "Host" header character validation to prevent cache poisoning attacks when ``base_url`` auto-detection is used.
 
    -  :doc:`Security Library <libraries/security>` changes include:
 
diff --git a/user_guide_src/source/general/environments.rst b/user_guide_src/source/general/environments.rst
index d74ebb8d5..1ce4fde3a 100644
--- a/user_guide_src/source/general/environments.rst
+++ b/user_guide_src/source/general/environments.rst
@@ -20,7 +20,7 @@ the value provided in ``$_SERVER['CI_ENV']``, otherwise defaults to
 This server variable can be set in your .htaccess file, or Apache 
 config using `SetEnv <https://httpd.apache.org/docs/2.2/mod/mod_env.html#setenv>`_. 
 Alternative methods are available for nginx and other servers, or you can 
-remove this logic entirely and set the constant based on the HTTP_HOST or IP.
+remove this logic entirely and set the constant based on the server's IP address.
 
 In addition to affecting some basic framework behavior (see the next
 section), you may use this constant in your own development to