]> source.dussan.org Git - nextcloud-server.git/commit
Do only follow HTTP and HTTPS redirects
authorLukas Reschke <lukas@owncloud.com>
Thu, 11 Sep 2014 17:21:56 +0000 (19:21 +0200)
committerLukas Reschke <lukas@owncloud.com>
Mon, 22 Sep 2014 18:02:32 +0000 (20:02 +0200)
commit6eeb905871fc7a671f99fd22c2592358a6abc02d
tree391889ddb92d83a766a109cd7fc6bd58a4805691
parent70937dabcdf60a047000347523bfee7a53e673e6
Do only follow HTTP and HTTPS redirects

We do not want to follow redirects to other protocols since they might allow an adversary to bypass network restrictions. (i.e. a redirect to ftp:// might be used to access files of a FTP server which might be in a secure zone and not be reachable from the net but from the ownCloud server)

Get final redirect manually using get_headers()

Migrate to HTTPHelper class and add unit tests
apps/files/ajax/newfile.php
lib/private/files/storage/dav.php
lib/private/httphelper.php [new file with mode: 0644]
lib/private/server.php
lib/private/user/http.php
lib/private/util.php
lib/public/iservercontainer.php
tests/lib/httphelper.php [new file with mode: 0644]