fix #763 修复潜在的SSRF问题

application/common/model/Collect.php

@@ -161,6 +161,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param). base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -305,6 +309,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param). base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -984,6 +992,10 @@ class Collect extends Base {
         }
 
         $url .= http_build_query($url_param). base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -1306,6 +1318,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param).base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -1593,6 +1609,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param).base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -1887,6 +1907,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param).base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -2172,6 +2196,10 @@ class Collect extends Base {
             $url .='&';
         }
         $url .= http_build_query($url_param).base64_decode($param['param']);
+        $result = $this->checkCjUrl($url);
+        if ($result['code'] > 1) {
+            return $result;
+        }
         $html = mac_curl_get($url);
         if(empty($html)){
             return ['code'=>1001, 'msg'=>lang('model/collect/get_html_err')];
@@ -2414,4 +2442,16 @@ class Collect extends Base {
         }
     }
 
-}
+    /**
+     * 检查url合法性
+     * https://github.com/magicblack/maccms10/issues/763
+     */
+    private function checkCjUrl($url)
+    {
+        $result = parse_url($url);
+        if (empty($result['host']) || in_array($result['host'], ['127.0.0.1', 'localhost'])) {
+            return ['code' => 1001, 'msg' => lang('model/collect/cjurl_err')];
+        }
+        return ['code' => 1];
+    }
+}

application/install/controller/Index.php

@@ -20,6 +20,7 @@ class Index extends Controller
             header('HTTP/1.1 403 Forbidden');
             exit();
         }
+        parent::__construct($request);
     }
 
     public function index($step = 0)

application/lang/zh-cn.php

@@ -602,6 +602,7 @@ https://www.baidu.com/123.jpg
     'model/cash/mush_money_err'=>'提现太多了,没有这么多积分哦！',
 
     'model/collect/flag_err'=>'flag标识错误，请勿非法请求！',
+    'model/collect/cjurl_err'=>'采集链接有误或不能为本地链接',
     'model/collect/get_html_err'=>'连接API接口失败，通常为服务器网络不稳定、IP被封、禁用相关函数！',
     'model/collect/json_err'=>'JSON格式不正确，不支持采集',
     'model/collect/xml_err'=>'XML格式不正确，不支持采集',

application/lang/zh-tw.php

@@ -602,6 +602,7 @@ https://www.baidu.com/123.jpg
     'model/cash/mush_money_err'=>'提現太多了,沒有這麽多積分哦！',
 
     'model/collect/flag_err'=>'flag標識錯誤，請勿非法請求！',
+    'model/collect/cjurl_err'=>'採集鏈接有誤或不能為本地鏈接',
     'model/collect/get_html_err'=>'連接API接口失敗，通常為服務器網絡不穩定、IP被封、禁用相關函數！',
     'model/collect/json_err'=>'JSON格式不正確，不支持采集',
     'model/collect/xml_err'=>'XML格式不正確，不支持采集',