L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-48495 curl: Limit usage of curl to HTTP and HTTPS protocols

Browse Source
This commit is contained in:
Frederic Massart
2014-12-16 10:08:54 +00:00
committed by Dan Poltawski
parent d70814b233
commit 195c33fcf3
2 changed files with 45 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/filelib.php
+6 -12
View File
@@ -3153,14 +3153,6 @@ class curl {
* @return resource The curl handle
*/
private function apply_opt($curl, $options) {
// Some more security first.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
if (defined('CURLOPT_REDIR_PROTOCOLS')) {
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Clean up
$this->cleanopt();
// set cookie
@@ -3222,12 +3214,14 @@ class curl {
$this->options['CURLOPT_FOLLOWLOCATION'] = 0;
}
// Limit the protocols to HTTP and HTTPS.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Set options.
foreach($this->options as $name => $val) {
if ($name === 'CURLOPT_PROTOCOLS' or $name === 'CURLOPT_REDIR_PROTOCOLS') {
// These can not be changed, sorry.
continue;
}
if ($name === 'CURLOPT_FOLLOWLOCATION' and $this->emulateredirects) {
// The redirects are emulated elsewhere.
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 0);