plone/plone.app.theming — pull request #7 by davidjb (2012-09-26 00:04:51+00:00)
Title: Ensure hostname blacklisting correctly determines incoming hostname

At present, plone.app.theming relies on BASE1 from the request object in order to attempt to ascertain the hostname of the request. These BASEx variables encompass the path to a Plone site/Zope install -- and are problematic when a site is hosted on a sub-directory (or sub-sub-directory, etc). Since BASE1 contains a path, this isn't necessarily going to be just the server URL.

Looking at the ZPublisher, SERVER_URL is built up from the relevant CGI-style environment variables and should be value used.