From 27eb48b32f9d7b4a303706b3bbc2a61dbaaebb19 Mon Sep 17 00:00:00 2001
From: Lars Gebhardt-Kusche <lars@kusche.berlin>
Date: Mon, 2 Feb 2026 23:53:44 +0100
Subject: [PATCH] asdasd

---
 config/current.ver |  2 +-
 src/ApiKernel.php  | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/config/current.ver b/config/current.ver
index 67eb680..9579e1f 100644
--- a/config/current.ver
+++ b/config/current.ver
@@ -1 +1 @@
-1.2.12
\ No newline at end of file
+1.2.13
\ No newline at end of file
diff --git a/src/ApiKernel.php b/src/ApiKernel.php
index 0aafae3..2741bcd 100644
--- a/src/ApiKernel.php
+++ b/src/ApiKernel.php
@@ -4870,9 +4870,22 @@ SQL;
     private function ensureDebugEnv(): void
     {
         $env = strtolower((string)($this->conf['env'] ?? ''));
-        if ($env !== 'staging') {
-            $this->fail('Debug nur in Staging erlaubt', null, 403);
+        if ($env === 'staging') {
+            return;
         }
+        $host = '';
+        if (!empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
+            $host = strtolower(trim(explode(',', (string)$_SERVER['HTTP_X_FORWARDED_HOST'])[0]));
+        } elseif (!empty($_SERVER['HTTP_HOST'])) {
+            $host = strtolower((string)$_SERVER['HTTP_HOST']);
+        }
+        if ($host !== '') {
+            $host = preg_replace('/:\\d+$/', '', $host);
+            if ($host === 'staging.emailtemplate.it') {
+                return;
+            }
+        }
+        $this->fail('Debug nur in Staging erlaubt', null, 403);
     }
 
     private function debugDir(): string