prevent evil "Proxy" header being sent, see https://httpoxy.org for details

[mailer.git] / inc / http-functions.php

diff --git a/inc/http-functions.php b/inc/http-functions.php
index 4fc66c95a5a94a4850f1af9106d3a284b9e34ace..acc3c6d5e6b8eddc737a6c151a913d0c14fd36f1 100644 (file)
--- a/inc/http-functions.php
+++ b/inc/http-functions.php
@@ -10,13 +10,8 @@
  * -------------------------------------------------------------------- *
  * Kurzbeschreibung  : HTTP-relevante Funktionen                        *
  * -------------------------------------------------------------------- *
- * $Revision::                                                        $ *
- * $Date::                                                            $ *
- * $Tag:: 0.2.1-FINAL                                                 $ *
- * $Author::                                                          $ *
- * -------------------------------------------------------------------- *
  * Copyright (c) 2003 - 2009 by Roland Haeder                           *
- * Copyright (c) 2009 - 2013 by Mailer Developer Team                   *
+ * Copyright (c) 2009 - 2016 by Mailer Developer Team                   *
  * For more information visit: http://mxchange.org                      *
  *                                                                      *
  * This program is free software; you can redistribute it and/or modify *
@@ -278,7 +273,7 @@ function sendHttpPostRequest ($baseUrl, $requestData = array(), $removeHeader =
        $body = http_build_query($requestData, '', '&');
 
        // Generate POST request header
-       $request  = 'POST ' . (isProxyUsed() === TRUE ? $baseUrl : '') . trim($baseUrl) . ' HTTP/1.0' . getConfig('HTTP_EOL');
+       $request  = 'POST ' . (isProxyUsed() === TRUE ? $getUrl : '') . trim($getUrl) . ' HTTP/1.0' . getConfig('HTTP_EOL');
        $request .= 'Host: ' . $host . getConfig('HTTP_EOL');
        $request .= 'Referer: ' . getUrl() . '/admin.php' . getConfig('HTTP_EOL');
        if (isConfigEntrySet('FULL_VERSION')) {
@@ -343,8 +338,14 @@ function sendRawRequest ($host, $request, $allowOnlyHttpOkay = TRUE) {
        // Get resolver instance
        $resolver = new HostnameResolver();
 
-       // Get proxy host
-       $proxyHost = compileRawCode(getProxyHost());
+       // Default is no proxy
+       $proxyHost = NULL;
+
+       // Is the configuration entry set?
+       if ((!isInstaller()) && (isConfigEntrySet('proxy_host'))) {
+               // Get proxy host
+               $proxyHost = compileRawCode(getProxyHost());
+       } // END - if
 
        // Open connection
        if (isProxyUsed() === TRUE) {
@@ -643,11 +644,13 @@ function extractHostnameFromUrl (&$script) {
        // Is this URL valid?
        if (substr($script, 0, 7) == 'http://') {
                // Use the hostname from script URL as new hostname
-               $url = substr($script, 7);
-               $extract = explode('/', $url);
+               $extract = explode('/', substr($script, 7));
                $url = $extract[0];
-               // Done extracting the URL :)
-       } // END - if
+       } elseif (substr($script, 0, 8) == 'https://') {
+               // Use the hostname from script URL as new hostname
+               $extract = explode('/', substr($script, 8));
+               $url = $extract[0];
+       }
 
        // Extract host name
        $host = str_replace(array('http://', 'https://'), array('', ''), $url);
@@ -685,8 +688,14 @@ function extractHostnameFromUrl (&$script) {
 
 // Adds a HTTP header to array
 function addHttpHeader ($header) {
+       // Is 'Proxy' set?
+       if (substr(trim(strtolower($header)), 0, 6) == 'proxy:') {
+               // Don't allow this header being sent
+               reportBug(__FUNCTION__, __LINE__, 'Security-relevant HTTP header "Proxy" detected. Please do not set this. See https://httpoxy.org/ for details.');
+       } // END - if
+
        // Send the header
-       //* DEBUG: */ logDebugMessage(__FUNCTION__ . ': header=' . $header);
+       //* DEBUG: */ logDebugMessage(__FUNCTION__, __LINE__, ': header=' . $header);
        array_push($GLOBALS['http_header'], trim($header));
 }
 
@@ -903,7 +912,7 @@ function getContentType () {
 // Logs wrong SERVER_NAME attempts
 function logWrongServerNameRedirect () {
        // Is ext-sql_patches at least version 0.9.2?
-       if (isExtensionInstalledAndNewer('sql_patches', '0.9.2')) {
+       if (isExtensionInstalled('server_name')) {
                // Is there an entry?
                if (countSumTotalData(detectServerName(), 'server_name_log', 'server_name_id', 'server_name', TRUE, str_replace('%', '{PER}', sprintf(" AND `server_name_remote_addr`='%s' AND `server_name_ua`='%s' AND `server_name_referrer`='%s'", sqlEscapeString(detectRemoteAddr(TRUE)), sqlEscapeString(detectUserAgent(TRUE)), sqlEscapeString(detectReferer(TRUE))))) == 1) {
                        // Update counter, as all are the same
@@ -936,5 +945,17 @@ LIMIT 1",
        } // END - if
 }
 
+// Check if response status OK and array index 'response' is set
+function isHttpResponseStatusOkay ($response) {
+       // Assertion on array
+       assert(is_array($response));
+
+       // Test it
+       $isOkay = ((isset($response['status'])) && ($response['status'] == 'OK'));
+
+       // Return result
+       return $isOkay;
+}
+
 // [EOF]
 ?>