lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix test on Local url

Browse Source
This commit is contained in:
Laurent Destailleur 2021-04-25 22:11:57 +02:00
parent bc0f220ee3
commit c3d3b79315
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/core/lib/geturl.lib.php
View File

@ -155,7 +155,7 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation =
// Deny some reserved host names
if (in_array($hosttocheck, array('metadata.google.internal'))) {
$info['http_code'] = 400;
$info['content'] = 'Error bad hostname (Used by Google metadata). This value for hostname is not allowed.';
$info['content'] = 'Error bad hostname '.$hosttocheck.' (Used by Google metadata). This value for hostname is not allowed.';
break;
}
@ -197,10 +197,11 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation =
$info['content'] = 'Error bad hostname IP (IP is a local IP defined into MAIN_SECURITY_SERVER_IP). Must be an external URL.';
break;
}
} else { // Only local url allowed (dangerous, may allow to get metadata on server or make internal port scanning)
}
if ($localurl == 1) { // Only local url allowed (dangerous, may allow to get metadata on server or make internal port scanning)
if (filter_var($iptocheck, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
$info['http_code'] = 400;
$info['content'] = 'Error bad hostname. Must be a local URL.';
$info['content'] = 'Error bad hostname '.$iptocheck.'. Must be a local URL.';
break;
}
if (!empty($conf->global->MAIN_SECURITY_ANTI_SSRF_SERVER_IP) && !in_array($iptocheck, explode(',', '127.0.0.1,::1,'.$conf->global->MAIN_SECURITY_ANTI_SSRF_SERVER_IP))) {
@ -209,6 +210,7 @@ function getURLContent($url, $postorget = 'GET', $param = '', $followlocation =
break;
}
}
// Common check (local and external)
if (in_array($iptocheck, array('100.100.100.200'))) {
$info['http_code'] = 400;