L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-48495 curl: Limit usage of curl to HTTP and HTTPS protocols

Browse Source
This commit is contained in:
Frederic Massart
2014-12-16 10:08:54 +00:00
committed by Dan Poltawski
parent d70814b233
commit 195c33fcf3
2 changed files with 45 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/filelib.php
+6 -12
View File
@@ -3153,14 +3153,6 @@ class curl {
* @return resource The curl handle
*/
private function apply_opt($curl, $options) {
// Some more security first.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
if (defined('CURLOPT_REDIR_PROTOCOLS')) {
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Clean up
$this->cleanopt();
// set cookie
@@ -3222,12 +3214,14 @@ class curl {
$this->options['CURLOPT_FOLLOWLOCATION'] = 0;
}
// Limit the protocols to HTTP and HTTPS.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Set options.
foreach($this->options as $name => $val) {
if ($name === 'CURLOPT_PROTOCOLS' or $name === 'CURLOPT_REDIR_PROTOCOLS') {
// These can not be changed, sorry.
continue;
}
if ($name === 'CURLOPT_FOLLOWLOCATION' and $this->emulateredirects) {
// The redirects are emulated elsewhere.
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 0);
lib/tests/filelib_test.php
+39
View File
@@ -504,6 +504,45 @@ class core_filelib_testcase extends advanced_testcase {
$this->assertSame('OK', $contents);
}
public function test_curl_protocols() {
// HTTP and HTTPS requests were verified in previous requests. Now check
// that we can selectively disable some protocols.
$curl = new curl();
// Other protocols than HTTP(S) are disabled by default.
$testurl = 'file:///';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = 'ftp://nowhere';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = 'telnet://somewhere';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
// Protocols are also disabled during redirections.
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'file'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'ftp'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'telnet'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
}
/**
* Testing prepare draft area
*