CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...