--- rt-4.0.6/lib/RT/Interface/Web.pm	2012-05-15 08:24:09.000000000 +1000
+++ rt-patch-4.0.6/lib/RT/Interface/Web.pm	2012-07-12 13:21:33.000000000 +1000
@@ -1225,7 +1225,31 @@
     my $configs;
     for my $config ( $base_url, RT->Config->Get('ReferrerWhitelist') ) {
         push @$configs,$config;
-        return 1 if $referer->host_port eq $config;
+
+        # Are we attempting to do a wildcard match?
+        if ( (my $idx = index($config,'*')) != -1) {
+
+            # If the wildcard is at the start of the domain, strip it off
+            # and match against the parent domain.
+            # EG *.foobar.com matches foobar.com
+            if (($idx == 0) && 
+                    (substr($config,0,2) eq '*.') &&
+                    (substr($config,2) eq $referer->host_port)) {
+                # Matches parent domain.
+                return 1;
+            }
+
+            # Perform a wildcard match.
+            # run quotemeta so any perl regex commands are nullified.
+            # replace the escaped '*.$DOMAIN' with '.*.$DOMAIN' so we match any subdomains
+            my $quoted = quotemeta $config;
+            $quoted =~ s/\\\*\\\./.*\\./g;
+            if ($referer->host_port =~ m/$quoted$/) {
+                return 1;
+            }
+        } else {
+            return 1 if $referer->host_port eq $config;
+        }
     }
 
     return (0,$referer,$configs);
