Skip to content

Commit

Permalink
Merge branch 'master' into stream_php
Browse files Browse the repository at this point in the history
  • Loading branch information
jvoisin authored Jun 8, 2024
2 parents 78ef1b6 + c0c63e9 commit c472fd4
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 1 deletion.
4 changes: 4 additions & 0 deletions config/default.rules
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@ sp.disable_function.function("curl_setopt").param("value").value("2").allow();
sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off.");
sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");

# Ensure that file:// protocol is not allowed in CURL
sp.disable_function.function("curl_setopt").param("value").value_r("file://").drop().alias("file:// protocol is disabled");
sp.disable_function.function("curl_init").param("url").value_r("file://").drop().alias("file:// protocol is disabled");

# File upload
# On old PHP7 versions
#sp.disable_function.function("move_uploaded_file").param("destination").value_r("\\.ph").drop();
Expand Down
4 changes: 4 additions & 0 deletions config/default_php8.rules
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,10 @@ sp.disable_function.function("curl_setopt").param("value").value("2").allow();
sp.disable_function.function("curl_setopt").param("option").value("64").drop().alias("Please don't turn CURLOPT_SSL_VERIFYCLIENT off.");
sp.disable_function.function("curl_setopt").param("option").value("81").drop().alias("Please don't turn CURLOPT_SSL_VERIFYHOST off.");

# Ensure that file:// protocol is not allowed in CURL
sp.disable_function.function("curl_setopt").param("value").value_r("file://").drop().alias("file:// protocol is disabled");
sp.disable_function.function("curl_init").param("url").value_r("file://").drop().alias("file:// protocol is disabled");

# File upload
sp.disable_function.function("move_uploaded_file").param("to").value_r("\\.ph").drop();
sp.disable_function.function("move_uploaded_file").param("to").value_r("\\.ht").drop();
Expand Down
2 changes: 1 addition & 1 deletion debian/rules
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
%:
dh $@ --sourcedirectory src --with php

override_dh_auto_clean:
execute_after_dh_auto_clean:
cd ./src; phpize --clean

override_dh_auto_configure:
Expand Down

0 comments on commit c472fd4

Please sign in to comment.