moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-04 16:36:37 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-74289 lib: Improve the proxy bypass matching

Browse source
This commit is contained in:
raortegar 2023-07-26 13:35:35 +07:00 • committed by Huong Nguyen
parent e3d93edc6d
commit 3ef202da9c
No known key found for this signature in database
GPG key ID: 40D88AB693A3E72A
2 changed files with 71 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

19
lib/moodlelib.php
View file

@ -10261,25 +10261,14 @@ function is_proxybypass( $url ) {
// Get the possible bypass hosts into an array.
$matches = explode( ',', $CFG->proxybypass );
// Check for a match.
// (IPs need to match the left hand side and hosts the right of the url,
// but we can recklessly check both as there can't be a false +ve).
foreach ($matches as $match) {
$match = trim($match);
// Check for a exact match on the IP or in the domains.
$isdomaininallowedlist = \core\ip_utils::is_domain_in_allowed_list($host, $matches);
$isipinsubnetlist = \core\ip_utils::is_ip_in_subnet_list($host, $CFG->proxybypass, ',');
// Try for IP match (Left side).
$lhs = substr($host, 0, strlen($match));
if (strcasecmp($match, $lhs)==0) {
if ($isdomaininallowedlist || $isipinsubnetlist) {
return true;
}
// Try for host match (Right side).
$rhs = substr($host, -strlen($match));
if (strcasecmp($match, $rhs)==0) {
return true;
}
}
// Nothing matched.
return false;
}

66
lib/tests/moodlelib_test.php
View file

@ -5519,4 +5519,70 @@ EOT;
$this->assertEquals(false, html_is_blank('<p>.</p>'));
$this->assertEquals(false, html_is_blank('<img src="#">'));
}
/**
* Provider for is_proxybypass
*
* @return array of test cases.
*/
public function is_proxybypass_provider(): array {
return [
'Proxybypass contains the same IP as the beginning of the URL' => [
'http://192.168.5.5-fake-app-7f000101.nip.io',
'192.168.5.5, 127.0.0.1',
false
],
'Proxybypass contains the last part of the URL' => [
'http://192.168.5.5-fake-app-7f000101.nip.io',
'app-7f000101.nip.io',
false
],
'Proxybypass contains the last part of the URL 2' => [
'http://store.mydomain.com',
'mydomain.com',
false
],
'Proxybypass contains part of the url' => [
'http://myweb.com',
'store.myweb.com',
false
],
'Different IPs used in proxybypass' => [
'http://192.168.5.5',
'192.168.5.3',
false
],
'Proxybypass and URL matchs' => [
'http://store.mydomain.com',
'store.mydomain.com',
true
],
'IP used in proxybypass' => [
'http://192.168.5.5',
'192.168.5.5',
true
],
];
}
/**
* Check if $url matches anything in proxybypass list
*
* Test function {@see is_proxybypass()}.
* @dataProvider is_proxybypass_provider
* @param string $url url to check
* @param string $proxybypass
* @param bool $expected Expected value.
*/
public function test_is_proxybypass(string $url, string $proxybypass, bool $expected): void {
$this->resetAfterTest();
global $CFG;
$CFG->proxyhost = '192.168.5.5'; // Test with a fake proxy.
$CFG->proxybypass = $proxybypass;
$this->assertEquals($expected, is_proxybypass($url));
}
}