mirror/FreshRSS
0
0
Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-05-14 18:23:52 -04:00
Code Issues Packages Projects Releases Wiki Activity

Limit cURL to protocols HTTP, HTTPS (#8713)

Browse Source
This commit is contained in:
Alexandre Alapetite
2026-04-22 22:27:17 +02:00
committed by GitHub
parent 3ec1920cc5
commit 497d6a7afb
4 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
app/Controllers/updateController.php
View File

@@ -229,6 +229,24 @@ class FreshRSS_update_Controller extends FreshRSS_ActionController {
curl_setopt($curlResource, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curlResource, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($curlResource, CURLOPT_SSL_VERIFYHOST, 2);
$curl_options = [];
if (defined('CURLOPT_PROTOCOLS_STR')) {
$curl_options[CURLOPT_PROTOCOLS_STR] = 'http,https';
if (defined('CURLOPT_REDIR_PROTOCOLS_STR')) {
$curl_options[CURLOPT_REDIR_PROTOCOLS_STR] = 'http,https';
}
} elseif (defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS')) {
// Legacy PHP 8.2-
if (defined('CURLOPT_PROTOCOLS')) {
$curl_options[CURLOPT_PROTOCOLS] = CURLPROTO_HTTP | CURLPROTO_HTTPS;
}
if (defined('CURLOPT_REDIR_PROTOCOLS')) {
$curl_options[CURLOPT_REDIR_PROTOCOLS] = CURLPROTO_HTTP | CURLPROTO_HTTPS;
}
}
curl_setopt_array($curlResource, $curl_options);
$result = curl_exec($curlResource);
$curlGetinfo = curl_getinfo($curlResource, CURLINFO_HTTP_CODE);
$curlError = curl_error($curlResource);