diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/lib_rss.php | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/lib/lib_rss.php b/lib/lib_rss.php index b7c3817ee..532a9902a 100644 --- a/lib/lib_rss.php +++ b/lib/lib_rss.php @@ -319,8 +319,27 @@ function customSimplePie(array $attributes = [], array $curl_options = []): \Sim } } if (!empty($attributes['curl_params']) && is_array($attributes['curl_params'])) { + $safe_params = [ + CURLOPT_COOKIE, + CURLOPT_COOKIEFILE, + CURLOPT_FOLLOWLOCATION, + CURLOPT_HTTPHEADER, + CURLOPT_MAXREDIRS, + CURLOPT_POST, + CURLOPT_POSTFIELDS, + CURLOPT_PROXY, + CURLOPT_PROXYTYPE, + CURLOPT_USERAGENT, + ]; foreach ($attributes['curl_params'] as $co => $v) { if (is_int($co)) { + if (!in_array($co, $safe_params, true)) { + continue; + } + if ($co === CURLOPT_COOKIEFILE) { + // Allow only an empty value just to enable the libcurl cookie engine + $v = ''; + } $curl_options[$co] = $v; } } |