When using a whitelist no urls are validated. The function imagecache_external_fetch does not extract the hostname from the supplied url for checking against the whitelist.

CommentFileSizeAuthor
#1 imagecache_external-whitelist-hosts-1058842-1.patch964 bytesspeedracer79

Comments

speedracer79’s picture

speedracer79 commented
Category: bug » task
Status: Active » Needs review
StatusFileSize
new imagecache_external-whitelist-hosts-1058842-1.patch964 bytes

See the attached patch. I added the php function parse_url to the imagecache_external_fetch function to extract the hostname from the url.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented

Cheers, must have dropped this between version 1 and 2.
Thanks

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Needs review » Fixed

Thanks
New version 6.x-2.0-beta2 includes variant of this patch.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.