moodle/moodle
3
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-08-05 00:46:50 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDL-71922 file: Enhance endless recursion requests protection

Browse source
This commit is contained in:
Huong Nguyen 2021-07-05 17:25:09 +07:00 • committed by Eloy Lafuente (stronk7)
parent 1f45155354
commit cb48219537
1 changed files with 14 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
repository/url/lib.php
View file

@ -36,7 +36,11 @@ require_once(__DIR__.'/locallib.php');
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/ */
class repository_url extends repository { class repository_url extends repository {
/** @var int Maximum time of recursion. */
const MAX_RECURSION_TIME = 5;
var $processedfiles = array(); var $processedfiles = array();
/** @var int Recursion counter. */
var $recursioncounter = 0;
/** /**
* @param int $repositoryid * @param int $repositoryid
@ -127,7 +131,16 @@ EOD;
$url = htmlspecialchars_decode(url_to_absolute($baseurl, $relativeurl)); $url = htmlspecialchars_decode(url_to_absolute($baseurl, $relativeurl));
} }
if (in_array($url, $this->processedfiles)) { if (in_array($url, $this->processedfiles)) {
// avoid endless recursion // Avoid endless recursion for the same URL with same parameters.
return;
}
// Remove the query string before check.
$recursioncheckurl = preg_replace('/\?.*/', '', $url);
if (in_array($recursioncheckurl, $this->processedfiles)) {
$this->recursioncounter++;
}
if ($this->recursioncounter >= self::MAX_RECURSION_TIME) {
// Avoid endless recursion for the same URL with different parameters.
return; return;
} }
$this->processedfiles[] = $url; $this->processedfiles[] = $url;