From b565d497f9f9684ab111cc697add3e4b2af88a5a Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Wed, 25 Mar 2026 22:49:00 +0100 Subject: [PATCH] FIX #GHSA-hh5p-m24x-fwx2 block ssrf when using webhooks --- ...face_95_modWebhook_WebhookTriggers.class.php | 4 +++- htdocs/webhook/target_card.php | 17 +++++++++-------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/htdocs/core/triggers/interface_95_modWebhook_WebhookTriggers.class.php b/htdocs/core/triggers/interface_95_modWebhook_WebhookTriggers.class.php index 98cb2a8a538..977c902eeb0 100644 --- a/htdocs/core/triggers/interface_95_modWebhook_WebhookTriggers.class.php +++ b/htdocs/core/triggers/interface_95_modWebhook_WebhookTriggers.class.php @@ -124,7 +124,9 @@ class InterfaceWebhookTriggers extends DolibarrTriggers } // warning; the test page use its own call - $response = getURLContent($tmpobject->url, $method, $jsonstr, 1, $headers, array('http', 'https'), 2, -1); + global $dolibarr_allow_localurl_for_webhooks; + $localurl = empty($dolibarr_allow_localurl_for_webhooks) ? 0 : 2; + $response = getURLContent($tmpobject->url, $method, $jsonstr, 1, $headers, array('http', 'https'), $localurl, -1); $errormsg = ""; if (empty($response['curl_error_no']) && $response['http_code'] >= 200 && $response['http_code'] < 300) { diff --git a/htdocs/webhook/target_card.php b/htdocs/webhook/target_card.php index 341dd9db66b..5edd96bdaf8 100644 --- a/htdocs/webhook/target_card.php +++ b/htdocs/webhook/target_card.php @@ -25,13 +25,6 @@ // Load Dolibarr environment require '../main.inc.php'; -require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; -require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php'; -require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php'; -require_once DOL_DOCUMENT_ROOT.'/webhook/class/target.class.php'; -require_once DOL_DOCUMENT_ROOT.'/webhook/lib/webhook_target.lib.php'; -require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php'; - /** * @var Conf $conf * @var DoliDB $db @@ -40,6 +33,12 @@ require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php'; * @var Translate $langs * @var User $user */ +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php'; +require_once DOL_DOCUMENT_ROOT.'/core/class/html.formprojet.class.php'; +require_once DOL_DOCUMENT_ROOT.'/webhook/class/target.class.php'; +require_once DOL_DOCUMENT_ROOT.'/webhook/lib/webhook_target.lib.php'; +require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php'; // Load translation files required by the page $langs->loadLangs(array('other','admin')); @@ -180,7 +179,9 @@ if (empty($reshook)) { } // TODO Replace this by a call of trigger... - $response = getURLContent($url, $method, $jsondata, 1, $headers, array('http', 'https'), 2, -1); + global $dolibarr_allow_localurl_for_webhooks; + $localurl = empty($dolibarr_allow_localurl_for_webhooks) ? 0 : 2; + $response = getURLContent($url, $method, $jsondata, 1, $headers, array('http', 'https'), $localurl, -1); if (empty($response['curl_error_no']) && $response['http_code'] >= 200 && $response['http_code'] < 300) { setEventMessages($langs->trans("Success"), null); } else {