fixed ssrf vulnerability

2023-02-01 13:12:12 +01:00 · 2023-02-01 13:12:12 +01:00 · 022ca1c6a4
parent 6d2f4d7eac
commit 022ca1c6a4
1 changed files with 9 additions and 0 deletions
--- a/pandora_console/extensions/api_checker.php
+++ b/pandora_console/extensions/api_checker.php
@ -103,6 +103,15 @@ function api_execute(
        }
    }

+    $url_protocol = parse_url($url)['scheme'];
+
+    if ($url_protocol !== 'http' && $url_protocol !== 'https') {
+        return [
+            'url'    => $url,
+            'result' => '',
+        ];
+    }
+
    $curlObj = curl_init($url);
    if (empty($data) === false) {
        $url .= http_build_query($data);