Merge branch 'ent-10159-Server-side-request-forgery-in-api-checker' into 'develop'

fixed ssrf vulnerability See merge request artica/pandorafms!5489
2023-02-01 15:45:29 +00:00 · 2023-02-01 15:45:29 +00:00 · 997a8d5434
parent da83dee4d9 022ca1c6a4
commit 997a8d5434
1 changed files with 9 additions and 0 deletions
--- a/pandora_console/extensions/api_checker.php
+++ b/pandora_console/extensions/api_checker.php
@ -103,6 +103,15 @@ function api_execute(
        }
    }

+    $url_protocol = parse_url($url)['scheme'];
+
+    if ($url_protocol !== 'http' && $url_protocol !== 'https') {
+        return [
+            'url'    => $url,
+            'result' => '',
+        ];
+    }
+
    $curlObj = curl_init($url);
    if (empty($data) === false) {
        $url .= http_build_query($data);