public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-16 03:35:57 +00:00
Code Issues Releases Wiki Activity

- fix multiple vulnerabilities in af_proxy_http

Browse Source 
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
This commit is contained in:
Andrew Dolgov
2020-09-14 19:46:52 +03:00
parent 5b17fdc362
commit c3d14e1fa5
9 changed files with 72 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
classes/pref/feeds.php
View File

@@ -1701,7 +1701,7 @@ class Pref_Feeds extends Handler_Protected {
foreach ($feeds as $feed) {
$feed = trim($feed);
if (Feeds::validate_feed_url($feed)) {
if (validate_url($feed)) {
$this->pdo->beginTransaction();