I am happy to prepare a pull request for this if the approach is acceptable.

Adding a screenshot of the error page.

The description refers to an HTML capture, but the saved HTML references
44 external CSS/JS files and therefore does not render correctly when
opened standalone. The attached screenshot shows what an administrator
actually sees.

400-invalid-hostname.png (46,202 bytes)   

400-invalid-hostname.png (46,202 bytes)   

The error page tells the administrator which file controls this, so that

No, it's not for all user (and clearly not for hacker)
In my opinion, it must be logged as an error, showing instructions on how to fix (maybe new category for logguing).

Idea :

1. Add at Yii::log("400 error due to invalid request, invalid hostname {$hostInfo} not found in allowedHosts config', 'error', 'application.limesurvey.core.LSHttpRequest.checkIsAllowedHost') at https://github.com/LimeSurvey/LimeSurvey/blob/81a170f618ca5395b9c9d57cd21ec60025720b03/application/core/LSHttpRequest.php#L313
2. Add error log file : 'level'='error, 'categories' => 'application.limesurvey.*' in internal (limesurbey-error for name ?)
3. Add "If you are administrator, you can check log file in runtime directory"

However, writing a log file to a public directory is a bad idea.

However, writing a log file to a public directory is a bad idea.

We already do it for plugin.log

And not public if use apache (issue #20425 for example)

I am not sure which side is correct, sorry. But I tryed on my install
(7.0.11) and maybe this is useful.

Apache and nginx are different here. On my server (Apache behind nginx as
reverse proxy) the log is protected:

GET /tmp/runtime/plugin.log  -> 403

But nginx does not read .htaccess at all, so with PHP-FPM + nginx the same
file is just returned. The .htaccess comment also says "With a correct apache
configuration", so it depends on the setup.

My feeling, if I may say: I am a little afraid to depend on the web server
for this. Maybe CSysLogRoute is an option too? It is already in the bundled
Yii and it writes no file.

Anyway that is your decision. Can I prepare a pull request for the parts that
nobody disagree - the Yii::log() call, and keeping the 400 page generic with
one line to check the server log? Those do not depend on where the log goes.
If you want to fix the place first, I can wait, no problem.

However, writing a log file to a public directory is a bad idea.

14637: New install : allow to set runtimePath at installer

@coffee-jinn-2002 maybe you do not have plugin installed and log error.

Thank you for 14637, I did not know it. That is exactly the place question,
and it is from 2019, so I think it is separate from this ticket.

About the plugin - yes, I have one (our own), so plugin.log exists here (438
bytes). It contains survey ids like "sid=358973 4/4", so 14637 makes a lot
of sense to me.

But I should also say the 403 is not really about the file. The .htaccess
denies the whole directory, so a name that does not exist gives 403 too:

/tmp/runtime/plugin.log                -> 403
/tmp/runtime/no-such-file-12345.log    -> 403

So on Apache it is protected even with no log file, and on nginx none of this
applies.

Then, can I make the pull request for the Yii::log() part and the generic
page text? The place can be decided in 14637, I think.

I don't like either solution.
What is the user story here? Under what circumstance would someone have a problem and not know what to do?
Could we maybe show a more elaborate message if debug mode is active?

Fixed in Release 7.1.2+260917

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40385