From 7779d71711f6d87866b79d01f483f46f2277ff41 Mon Sep 17 00:00:00 2001 From: Phil Date: Fri, 24 May 2024 08:24:56 +0200 Subject: [PATCH] Make parrameters configurable --- de.systopia.civiproxy-0.6.0.tar.gz | Bin 0 -> 9940 bytes proxy/config.dist.php | 18 +++++++++++++++++- proxy/open.php | 8 +------- proxy/url.php | 8 +------- 4 files changed, 19 insertions(+), 15 deletions(-) create mode 100644 de.systopia.civiproxy-0.6.0.tar.gz diff --git a/de.systopia.civiproxy-0.6.0.tar.gz b/de.systopia.civiproxy-0.6.0.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..26fd7bf15d75c9273a50e4fa9d75e943a00b5215 GIT binary patch literal 9940 zcmV;_CM($=iwFP!000001MEF(Q`^Y0`OL4F=x~so*phjs%Glmz1Ibc{JT8!X&lX9! zWNU2eAWJ^d2yn6d_uJhwqlYc9A%xAj7gZKZ^XTd6?&;Tzv@W;eX)MBt=U9F3!ka|l z)zp6Rs8<87H{09zyZ&aok^j}#i}kJT?X8W??ahtN7mf9;#^&Y=w*9zhlwV0KoQSa( zlac4&)oxM!f9U0w@;|+!vMXycntaC?$l#rwty}oNxv{mmrTM?}X6Fs?|IM4NofoX} zXtTWI`hU*<)-S-@l@;4&dtXjJ)!!d{JUHGvJ=kaO4v!94z0TgE0I;z$W#I*nE+bEH z<^)sLA34F0$57*PCPF4gUd#rb&jHx0S1arlI~{R$a3y#UdtvZJcs}d53tP9VD zuJPFMeHM$P2R*}xIsHD5V=ox8h{s_P!4nGy1R3FR4a9g;F} z#ONm#75l=8?90o`?-G`W0lA;JAPr0917WmUKw3eXm5Qe}Rb14kc8eV!J0<&^(hhmSD!N9vJ(El^2 z^zQH6_rw1QBi}U{m=Y@d`ZZU&SQwCi@4~P<3vVHF243L4#o1I8dYUghiH?k><}ex%mWd# zQ5c?g(LLx#<1RP`18-QtHAj7Z^}XPnq2`N0^|@g`wp3FRXqR8uJh0Kw#ll8Nv0Va> z9G#Rh-P9MMyQ|s3*H-0CL8ujZRaFv!VQsT_dq*b+NDfkvSyhqLl3r}4@9FWE19EY| zxB)THvuUqo>*ZwZL}FT4EV4Do<8c@YfZ%!&3T~y_MJKb{tpe*x7Qn9RweLmHDeVu; z)&s{TfyPOAahFVcCB>@V(RW=KFtzH^0Z4*)7ZDWts>WX^^s&;4Y{O{YXsLMMv|Z4=yIn&VwJgWLqF_QGR14!(BDP?_A3i+%_=T( zsbDo<3GNv>d2}mzl~M6F%6SkHfaCjkYhM9ek}m1+G>t_%qMEMyWHO8(c0;+H>!j-{ z>9R?i*E?ZwsE1sZM3XQUhmTFB9MC06RY2p1l1r&12$OuL=kv;0+8=CE7<|qUF~8*l zjy#n==dsOP%w_1E1dlG1Daa*hokQX21oKNa=&WciqXT(B%z8AMNq9>VOb`B7%H;v! zaJxtzC>+bBaTyZ3Ui`Q;RsdIW-ssr7;_i}EPx1LH$-XaNkF~oWtV+D8wV>{;VE`)_6-anU-0T2G2@PwOrh*Uxz;eX+s{99v{ zLB2zkMjMB&H}G(7%=cn}15bG1QkHDO6wXXI@p-J#o?$YOqvyonnF6Na#G=%fLa?U% zSna*^!qDeVP-PYLVUa0n0BpeZz*PyffNTcoBJ|wH(x`IqW%a4zAMmR-OIuCyyx;!- zDOHp$YSjF&a+o>Q`fEOBPDfEaqXqNJ&`8mKiQbpa&*fb>7{E>ku=N1AJ7LaF0tr## zyWfdv_csuvW|K@v(C70unO^mAXF0NFI>tCk=FoMB_gtIHDR`X!B!nA6P z51H}G5?8{QS)a7z7VsXC>JsTHt1{|Ra5GsbXic*?D~#{cdF7O6j>+XDm>Db!%0%df zlr&z|!P;uXW6YFeA{n27#h7e+2|=B}U=urJzDS((WF#n~OdVrVBdNL<1T2OEVQb_J z8K;m;WyXP436KU_R#aV9nIbJi8LHk@bvL<8C20s3gU^suUsO?p=U}PnQoew_Y`38Y zm==)yHc;7dsgnzX7e?11t)fP0aF5w7g0!3VBYddrtO1y}nQ57MxHst?E@&kjgaHM- z`KFqck^)%0I|oMp_Wcmdhnh&m0EYseH&csk}@1>|WRm06YCl2)1<7HK+P znJSON2v&uLLPhDa$bip<=QNyyVGxLH+w23zlxTFn?VQ!kUpi>%4k>w9}^!lL0Pr-?cO9U?yDSDJvixdPZ zc>_}<*j=VbjDpQN#hfw@1df(JWl;jokSEO#C|a;UTdyB2_o-*FZ2B{u@!D#7pK~Xa znwU)nVbfW^AvFc}Oe|$oD@!ayC<>zwYOl7<;t3dZF{l{WqfXvFZAs7| z9!i5R{d`vWJGi?s`+HmkcZ9&!?uCLDaWRU*OBV3UEJ=KD)#nprYNdc)VIwVL11Va2E0=ZFwdYM1enZm1V+0jg}FYn>)sy6OGxryQD*s^=uwp z5|OlYR!ZJu)OHy;lL?PhoC<1Yn1Fu*?k1kL2{S>E;fod)JjVsPB|*8886k{#iE&jH zJ5%sqjZXo1b+Eqh*c2aw!V(DH8&ASG_At96LImYPNDqRQc<~4VT5-vFz=%FNXeO~_ zWD_id?FGE=hM3Qt%H)*95Fx3sjE;>JVZgYEitxtiwpEn?XQdR*SaNRAT$3d|n1-jk z08<|Hr}L^7G%c{-3b?S52Dit`4+w~fsKp>S3qXsNyIFja?S0C&RrX8Ttx0ifZpR>q zc?9ag0fT?x4JAK;vk9<_kC`Jdap7G6Ur6W~ohIOH+O(W9 zBWOoIAaGC#GNsS>5e7BJts&@vF&@xTTkDa6Dkg(4;Jhx#y0(0NEAU zCnSFCgbNh2*qq0dW?82>(Jf%%5lL7@Vq=5q^Fay)pxjFYW_4uxMGX#%+=u0Yf;SD5 z>I{=H#khdSa=30r{_a?AYvPa0N{ng}Q7HkojVA#wIVCCGFyL$$A~oIcGDwdE)$}yR zw4<8WJca0(Mma0^QrT3=HIk_dibyNE4Ycx|9`{Z80Ijm*${x0FHZL4M0Ub%YNTXlN zx;sFP3vTM}>$>V&vF*3QxfyxXU@nOV1W^VI8upVYMln?<8v{Iy=<^Hi6Mf{I2VoKv zjy+^a3Vt>5Ll@m~Q_)`A`+*n5Vm6hNYmf_BQS8wyo%1P9ZcSz}iczS_Y~-o^EweOj zHC{e`R6bP9McSEUb0*AWY^FBNRmm$$o1}DDRwicv*HEF)QcLr%EW@PpCp7Lu{FV%% z>}zwYb zF?o7cU>J6BxUY^wgG1(#HI?=nmOsK6d$B%0JYGbPdBh4NSsgoAf4C1av5vS(S-*7r z^R8T3fUlZMEj^)CS(S1I%1*vfIlGXzz@@Q6O-WkpYhTBT|T$CnCf6)En znH?gfQe1NYX-kAm;63Ohp{;3fYk35vozPQV4I^*(4?c}kRROb(^8%15inJ*z3-wSq zovc|N-)Jc=K0zrPInvYCrA z#L({&&b}iYRZ`eRU5!<9c?dBJRLi$COx@hvO)XBKS)Bug94U^f#X@ewWG(ZKTcLx@ z6X#k!?7)lg#Pqgo@hdB<{|k02a>y-xgeIGg+O?SGlEL|sR9j0&H(yo5cSg`){MGMf zJ;hc2{+|~NLd;G-&KP&U{|EQ$Z{+)bTN@i2o7*oM>)YEKjpz6Op5ki#0&He#bE<8u zTMgrv&PpqL=M1cR`<55t=&VrNkZDPy11qeB8lsc7Xxa3P6&UDrFo*qFR?st6fHCSv z9&HA6WHtuFZFv}ur5#wDOeSF@6Fy@Z{>Lpl-x-1VULVlroxS&;k6N~V!Ww*kOTd3T z>X15ZIf)pBQRg>{9RzN~0hlV0)f@-uaH{$>ox96hwyZ&zb`fYRiTqe~hg*iowT%x@ zpS=dj@O22Iqm|;&6QiVO^~15P$FOrm0w{Cv_Vbyz4APu>%@%W}WXmC*NYXBel@0z) zg5)X#bwm^g-bi2o>+5@SDwL^njhRs^QYi8+`%-f7wS zC#+S{+G$ujb+95WTNg-qg4q8=0GT^fmwU!)m=uJqUJoQlOcnmny|ZmK2#!Q#t`+tp z`zd7<{$a9#ngz(#Y`ut(o&0ff`swrGo*Cx_7~?5`rc$IdhJ;Aq(T*u}aB0L7rw{8T zf8I&18CfBblzm!uI(X;)CaYZkYq#QYJ_NAT`~RCeZ#F^e?`&TV)%t@KfcvsOuhC>n2MLIIBo&&FYS*vz*DU&UVe2rd%_7F~YAONF^eZw2i#U z&^fu-tTBA2-99>ed+_n(;D?L~F%xihL!Z3z(A%>J6YQXyZ=2QjDiYenN>3_M| zhCqdElR1pSWYSGfSC|>^(><43uBB|0(=oa>gHRk#Rik4ms}CW(9P&t4pu^D3YEQs3 z=nGw`-Vdg#hAMMhISF&i+SKhZ%$6_o=e8oS6oXl(Uj&eIF(n}R4n&MwPwM3X=?u_B zQargo>Eg@(vJVy07KfTIcsfr;TO4bSt|zo3S4KI*_+g|wRbM(7MB!K^wNuKar<|P& z@UO}HM_)hU{|0YU#LE&^AG3QZ;_C5!9s(>trB?*hP+__lvcBV=(UHydfZNe^qx&1 zC|M}j)!iSOhbs5~@JQq1jd36Uf2)D{pRJwEjc5P=DX!c3Pwz@U$`}ub|F*Z*pZWh3 z*8=`$@!xl3gBQeqjh*d{nfR}JmKe($1H0tYh)|5 z*PYW(`=4Z5Sf_dEn{r(z8YVK^=A@^^^pWb8J=aL}#isAkZ|Te&ENj`hI@#C*AEKkE zg5R~X!vIV_C)a|uSMgL0S$t~}3|ls}mt8M8hQOWmMx$k`drI(0+P7@Uj32}Q^7Ws7 zVC7K^!2Rw2PGht2tpA_lTEu@$L4WTU58(gS_Otzel4}|Mlh*zYDY!rXq4t^oPjW5K zf3(^U6M}p5AAh!<`TrExJ^8O3p!>#Ye|1>&>x;Jko_GG1xnA9@tXz-8m0+IRHa)jatGcc?*=|-^ z6t!N9_+}5^%W-fS=eS8*F?|P*_Tv}Y(+>@QIX(hndt;1ZYm^HY5rpYH!b72s=hKHo zsEmrZ=v!5K&nxr-p}##Y(@EDh3=Xj^AaZRZs^uu--c=smg8&2fDWH>~YsQ4ih(~-$ zsCv^T4>^CXC!>VkOmSkM0-loMF6&L@>tpgubMh??M}Ci2zBvcjES{g-DyXX+f;#PU z6!B5tde+}^*WYZP-9fO}A7Mh963DN7OZC>coC)quL>yl+A?o3~WAwJA>t>&ozJ-K; zwT^nee%$pa_FqiyG>r@F|C8#vDZ&i-DD41Hq@y!yKY{*r)NROHo(9ceSE7@pCU9g zB0*U1g^|l6Bi{`>M#Tawa&<3y^VsOL=oigl+bA3wG6?HT7F97Jz83W2$!^PGVbJ%z z{&^eU`LuAay<*(n%c!wy-xK)%Gr74oJlAL%vrd#zGw=)*)BwP*Qbm3x9r;x&$*)B% zY1~}f8fbM_zZ*Mn{Fv{WY!vZ9+xVNoXiK9_$o&pzN_;da5OLf%Fgj{tw$o|ZL>TxL zZV44TEiafPg3@Y)-&)k4_~0pYHK292(5Z*Zfr zB}q%iu}d(7lIQ`VaJ`D4t@L=4Mdb^bEg22o*+M1*%%6$D<&2%90v?XL`7uORe(=2r z{ok_BLSie}|6v5z6j_q!@Qh0)D{9%9;?=j=O)s*`m9zTv#m}dn6>&AHARw1~%gR zn{0-TzQMqCprE&H^g<{e8#ih+^|O-lYNaKQ&?%FHr`zm*ITwyBB`Hf^>Xats5N%aO zzw_GvSH=8Wc8IlV;j79OQysf?&Du-+ZjAN6?Hy@X8%OdxzoM-WYsS{W>AVPIOl(Nl z=d}so0p$mNa@ZBaUGH`&Ly~A9Dyv*e1JK^-IjmsJp8AuCA_wHy<`xrb1;} zgvH{bSYA2*Dz+QyG5ML!#)8kBe{sv5ru-X)O!TOV6w4MwsWqA-}BC+T%p zx+C}`NoeR=z%@}u0~2`}cGB~fSYBNiT$vtdn6kSlv_5RQ zhyL%%>MZ{6gQU^@ZyoJ_DUONyKNJ7=*~+t-{pW+EN%|kTausIbemKU;e+&1&3oDB& zGx_gBr2jVi&zThX>tR*)pX7_@cXn}#mx9p5vKQe|*9uYO_AO4<0>6j3`Ko}>yk=OmCQ=Lq@{;EDw>uokci9BTam z9UCAXqjH=Bhe`c~!OuS%Uf7VaFWL1h-D6*b0aYllfTK$H)py zqMJCD zAs$zRs8}mDSN+9!;<+K+mZXbxQ-4w==mq_7Fr-kSrp?eR3gQ7!2`L6#D>VUbV^$V8 ziDC?s!zOk?2Pb$UZ6NS`@K{r;$MbaTbOQU*xf_p~)?^Q(2mePJvTuBzD}=o$3Br>|BeZi*eJ@5)rJ9`Cpy7#v!*O3JImExB z&p9YmKsg~%$JBLQzW!pE$ap&rdh#-gKVdW^K%xDm5@A%}%i4#;9JVq)tGMyxK_!Oe z#PlUsO-T=OuDC1T-MCe_)mABd{6!tmWC4kE~G<+Qbnhph1VI=>poTvUGOn61& zc%&HB$Z^?OMx8O@0y4cD3kucx`DXzN3pj@PSeXEmMzpgCPn2~VjvjhbQ(j&1pQ7E{d!_B zUba|z%cdx>^u^Yh#HV)OJ=#*sNW>?&~p%U5uPCjminPP*E2B(;!Y8%fz` zQp7e!B%oXDnvfw$7__SQvPQ)KF~|t{Qw~yAogS#o16?HJo^FaZMzn&hY{$e?0hSjY z03=jZdp-gN=5*MtAqdDUe&0Fx<=y)OvHA9c_4;9T3dXiH`C^SQD2Yt*B(Lj_`sfJ|+3kq)-~yxeoXGG3NDSaS zKe(Q_D-l-EjevQ=N-OygH!F}zUg=XMMtiPZmzKI4eWAi6luNnz1fCUhy~OMN(u|ID z3+*PPmO#v#Gxk~$l5$s6D2hyR7%(HO_~4SlDx^%lXptiaCP1mJ%sKf=Wn`M2!8oo? zcrwkDqcVf`m_7)Xy{ciLUsP*oLP4y!O;yVm_vW%#K9`vi1#fY{(1h8`msa>a3? zuf$BHbpR4&E?=>km_g;@$Mz(VhTT?c7j_k#a^pMEzX{%*Njio663)I!bPRt|sGJ-xPGY_CB?94_h z8X;9JJM-lNg^%jS(HN85OvvFJbvP`=TQ++L@9kf`ss0b8(fr?+TK(HJ{r&&y>cZ^) z|3T8Y{=dJ~zfJe?|AF?uv;P0~X`=qWm({;b)7$?qEG*6X|3T7J{hzh^n^+uh_xXQu zapl<$x%2<>%FO@w!=#!1$KPB31N|q5u{@6YCsI_)=QUjmtd(TN3xMWNo9~*+B4az0 z-416)$Kpa1uK@%Cp3A6|jC1;@f@gF_WuCin^(j6M!*1u-VR-Th^LRoZ4QxD8<*KjM zN@RL~RvTWLxc3!xdt>1{*U)GOuY4U)BXor1fLX3y1Z3J$pINE@V{}!mmEZf96d~`v znS1b>K;n#DTGg-V+YqC|uRJE}H-9vAb?~(Cjb~~HhyG@2eg~DMj+hA++vn^Xr^fFc zmjt`y)Oezb#kZ#90lK*N!u2j2~-)&=w$_1TfIM z1z4}tXP*n^3613$d5_#1!qBQl{qFT|K{rID6KXWR^u*^2{2ru|f0|?}R7-47pk)wO z;^lOj_`6paP6tYl>RKRiS~p1qg6Pr1EK7M|R4K@#hroStWUDraB~%}MZx$*?0VchC zbbzm-m!m67pRF+I%hXvcL^gZGOTBu9$4+?a8FU%h6N=!{$Y}JivvyWb;@PT&VX(Ii zqP|kt(PNREdqZ3l33r|5&2HLcwxtIFf_yCvJn%t6=4f22qRu%6b3SyVqx2e%ZW^Xi#P*Hq>RHKG8mlR)xwk zEFnKM30@Sa)kE8*Itmhr9rN-E-SGTIUtOg*y&o&(z%gUt5nuKz;D@;t;>f>ycsM(~ z#*Uk&5$rf#Utp--sk1kEFmSmXX)m4JGOV`Gf&nq+G z^WAmkPE-`L*&4_JI`~ zCdl|!43nJ<$;mZd*j&?W>r{NTms{ooh~{k70$A29c@N~h!kDjDsaNE=@#dvE#zlD5 zSuygLB@WBvWfgc?^iOIoq<-a9n*a9jBWS+n9c6Wl9IZ2*4CG08idVv@TZD^i8i%wjJ|Smp zLCk)_3_}4EjLk!=sUZQ5_G1Tdp0~IGKt5$OKoXoH|ZEwEW-?9r( zhH%R`so*ifutoTu41ntNln$F)n5%`F4*e(<%DKF#e4kWsh7o$b47eN*Qi5yjdUlXM zAE3vEc7@xcU2z=YYu3o~XlOl!5l(+UXJ7SSABJlkA7RwN*sH^r4gYz&Ie5`TB{1C* z@Cf|IV3?}F)dfD1h}4aRJ?4H~@C!9~G?7jO$X8 zeqWD_=>U>z?FB3AS%js@#4aI~EVHK@!j6sVQ8$&b!t6a}vprbnJ25cK_(04@qV{TQ zUs$3kqd;i8z%^LBb$xf>2q8@@ZRB6hqv(^NKp91iqf_Mq64iqu=s272DxX_to`RaI zUKb-Wv5KAMy~xakcQ(a1`Qr#?KtM4S9z(Fs&6%elnEm69BZsrGoPf9Lk>r@%QxG!j zPe_W%I3Y1k{wc^&(t~lds9X~gqBBoH1qx|@Ch5~ zA&2BFtsBC*3J?$29Z;8cphG(D6I(-4E~M(n}5*^z;ATaJ%i3E3~tNgEmkq-1?aO5}<5(JebQ z9jh0f%(RuA#<<2}>R_?dWK7m5x|}UG&Bg=6=Kw~0GP+SPOFeb+yp2*|E$CVXVX1qW zc-T+07jU%rUump79b09C9rrZ-JZ@VvWt<|W#$zi?d%YGzZAV?SFrTBq)yPfYSl2RP ztPKZQJ*9jk-w1ms6UMpQ!(!w4iX1LvFk~9M4$^?X=oxThg;cy}4`WhOro%5D4(U{E zf3gy?UG 'string' +$valid_url_parameters = [ + 'u' => 'int', + 'q' => 'int', + 'qid' => 'int', +// '*' => 'string' // whildcard, whitelist all url parameters +]; +$valid_open_parameters = [ + 'u' => 'int', + 'q' => 'int', + 'qid' => 'int', +// '*' => 'string' // wildcard, whitelist *all* open parameters +]; /**************************************************************** ** File Caching Options ** diff --git a/proxy/open.php b/proxy/open.php index c4e1200..fb45410 100644 --- a/proxy/open.php +++ b/proxy/open.php @@ -16,11 +16,5 @@ if (!$target_open) civiproxy_http_error("Feature disabled", 405); // basic check civiproxy_security_check('open'); -// basic restraints -$valid_parameters = [ - 'q' => 'int', - 'qid' => 'int', -]; - -$parameters = civiproxy_get_parameters($valid_parameters); +$parameters = civiproxy_get_parameters($valid_open_parameters); civiproxy_redirect($target_open, $parameters); diff --git a/proxy/url.php b/proxy/url.php index 83555cd..b68839c 100644 --- a/proxy/url.php +++ b/proxy/url.php @@ -16,11 +16,5 @@ if (!$target_url) civiproxy_http_error("Feature disabled", 405); // basic check civiproxy_security_check('url'); -// basic restraints -$valid_parameters = array( 'u' => 'int', - 'q' => 'int', - 'qid' => 'int', - '*' => 'string'); - -$parameters = civiproxy_get_parameters($valid_parameters); +$parameters = civiproxy_get_parameters($valid_url_parameters); civiproxy_redirect($target_url, $parameters);