mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-04-21 00:12:56 +02:00
Code Issues Projects Releases Wiki Activity

MDL-48495 curl: Limit usage of curl to HTTP and HTTPS protocols

Browse Source
This commit is contained in:
Frederic Massart 2014-12-05 18:24:41 +08:00 committed by Dan Poltawski
parent a87494c46f
commit 38a73bf4ae
2 changed files with 45 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/filelib.php
View File

@ -3166,14 +3166,6 @@ class curl {
* @return resource The curl handle
*/
private function apply_opt($curl, $options) {
// Some more security first.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
if (defined('CURLOPT_REDIR_PROTOCOLS')) {
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Clean up
$this->cleanopt();
// set cookie
@ -3235,12 +3227,14 @@ class curl {
$this->options['CURLOPT_FOLLOWLOCATION'] = 0;
}
// Limit the protocols to HTTP and HTTPS.
if (defined('CURLOPT_PROTOCOLS')) {
$this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
$this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS);
}
// Set options.
foreach($this->options as $name => $val) {
if ($name === 'CURLOPT_PROTOCOLS' or $name === 'CURLOPT_REDIR_PROTOCOLS') {
// These can not be changed, sorry.
continue;
}
if ($name === 'CURLOPT_FOLLOWLOCATION' and $this->emulateredirects) {
// The redirects are emulated elsewhere.
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 0);

39
lib/tests/filelib_test.php
View File

@ -504,6 +504,45 @@ class core_filelib_testcase extends advanced_testcase {
$this->assertSame('OK', $contents);
}
public function test_curl_protocols() {
// HTTP and HTTPS requests were verified in previous requests. Now check
// that we can selectively disable some protocols.
$curl = new curl();
// Other protocols than HTTP(S) are disabled by default.
$testurl = 'file:///';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = 'ftp://nowhere';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = 'telnet://somewhere';
$curl->get($testurl);
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
// Protocols are also disabled during redirections.
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'file'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'ftp'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
$testurl = $this->getExternalTestFileUrl('/test_redir_proto.php');
$curl->get($testurl, array('proto' => 'telnet'));
$this->assertNotEmpty($curl->error);
$this->assertEquals(CURLE_UNSUPPORTED_PROTOCOL, $curl->errno);
}
/**
* Testing prepare draft area
*