vignesh/dolibarr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FIX #GHSA-hh5p-m24x-fwx2 block ssrf when using webhooks

Browse source
This commit is contained in:
Laurent Destailleur 2026-03-25 22:49:00 +01:00
parent e9b2afa63c
commit b565d497f9
2 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
htdocs/core/triggers/interface_95_modWebhook_WebhookTriggers.class.php
View file

@ -124,7 +124,9 @@ class InterfaceWebhookTriggers extends DolibarrTriggers
}
// warning; the test page use its own call
$response = getURLContent($tmpobject->url, $method, $jsonstr, 1, $headers, array('http', 'https'), 2, -1);
global $dolibarr_allow_localurl_for_webhooks;
$localurl = empty($dolibarr_allow_localurl_for_webhooks) ? 0 : 2;
$response = getURLContent($tmpobject->url, $method, $jsonstr, 1, $headers, array('http', 'https'), $localurl, -1);
$errormsg = "";
if (empty($response['curl_error_no']) && $response['http_code'] >= 200 && $response['http_code'] < 300) {

17
htdocs/webhook/target_card.php
View file

@ -25,13 +25,6 @@
// Load Dolibarr environment
require '../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php';
require_once DOL_DOCUMENT_ROOT.'/webhook/class/target.class.php';
require_once DOL_DOCUMENT_ROOT.'/webhook/lib/webhook_target.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
/**
* @var Conf $conf
* @var DoliDB $db
@ -40,6 +33,12 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
* @var Translate $langs
* @var User $user
*/
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php';
require_once DOL_DOCUMENT_ROOT.'/webhook/class/target.class.php';
require_once DOL_DOCUMENT_ROOT.'/webhook/lib/webhook_target.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
// Load translation files required by the page
$langs->loadLangs(array('other','admin'));
@ -180,7 +179,9 @@ if (empty($reshook)) {
}
// TODO Replace this by a call of trigger...
$response = getURLContent($url, $method, $jsondata, 1, $headers, array('http', 'https'), 2, -1);
global $dolibarr_allow_localurl_for_webhooks;
$localurl = empty($dolibarr_allow_localurl_for_webhooks) ? 0 : 2;
$response = getURLContent($url, $method, $jsondata, 1, $headers, array('http', 'https'), $localurl, -1);
if (empty($response['curl_error_no']) && $response['http_code'] >= 200 && $response['http_code'] < 300) {
setEventMessages($langs->trans("Success"), null);
} else {