From eeb9977692ab697fbaa57c8ca76247ba43b91eb2 Mon Sep 17 00:00:00 2001 From: Matthew Hilton Date: Thu, 3 Apr 2025 13:51:36 +1000 Subject: [PATCH] MDL-85075 files: Use core security helper first --- public/lib/filelib.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/public/lib/filelib.php b/public/lib/filelib.php index e46df988fce..d0e72756f27 100644 --- a/public/lib/filelib.php +++ b/public/lib/filelib.php @@ -3709,6 +3709,15 @@ class curl { return null; } + // Check if the URL is blocked in core curl_security_helper or + // curl security helper that passed to curl class constructor. + // Note, we purposely check the configured helper first, + // as this may be being mocked for unit testing. + if ($this->securityhelper->url_is_blocked($url)) { + $this->error = $this->securityhelper->get_blocked_url_string(); + return $this->error; + } + // Augment all installed plugin's security helpers if there is any. // The plugin's function has to be defined as plugintype_pluginname_curl_security_helper in pluginname/lib.php. $plugintypes = get_plugins_with_function('curl_security_helper'); @@ -3727,13 +3736,6 @@ class curl { } } - // Check if the URL is blocked in core curl_security_helper or - // curl security helper that passed to curl class constructor. - if ($this->securityhelper->url_is_blocked($url)) { - $this->error = $this->securityhelper->get_blocked_url_string(); - return $this->error; - } - // Set allowed resolve info if the URL is not blocked. $this->curlresolveinfo = $this->securityhelper->get_resolve_info();