From 57ed3bdd482137fd2789ab5f9e1951a9910ce660 Mon Sep 17 00:00:00 2001 From: Beatrycze Volk Date: Wed, 21 Oct 2026 11:19:19 +0200 Subject: [PATCH] [SECURITY] Fix unauthenticated SSRF in frontend eID `tx_dlf_pageview_proxy` --- Classes/Eid/PageViewProxy.php | 10 ++++++++++ ext_emconf.php | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Classes/Eid/PageViewProxy.php b/Classes/Eid/PageViewProxy.php index a9f1d9a383..d72cadad6b 100644 --- a/Classes/Eid/PageViewProxy.php +++ b/Classes/Eid/PageViewProxy.php @@ -145,6 +145,16 @@ protected function handleHead(ServerRequestInterface $request): ResponseInterfac $queryParams = $request->getQueryParams(); $url = (string) ($queryParams['url'] ?? ''); + if (!Helper::isValidHttpUrl($url)) { + return new JsonResponse(['message' => 'Did not receive a valid URL.'], 400); + } + + // get and verify the uHash + $uHash = (string) ($queryParams['uHash'] ?? ''); + if (!hash_equals(GeneralUtility::hmac($url, 'PageViewProxy'), $uHash)) { + return new JsonResponse(['message' => 'No valid uHash passed!'], 401); + } + $headers = [ 'User-Agent' => $this->extConf['userAgent'] ?? 'Kitodo.Presentation' ]; diff --git a/ext_emconf.php b/ext_emconf.php index bc77095d75..ce58cf97f7 100644 --- a/ext_emconf.php +++ b/ext_emconf.php @@ -13,7 +13,7 @@ $EM_CONF[$_EXTKEY] = [ 'title' => 'Kitodo.Presentation', 'description' => 'Base plugins, modules, services and API of the Digital Library Framework. It is part of the community-based Kitodo Digitization Suite.', - 'version' => '5.0.10', + 'version' => '5.0.11', 'category' => 'misc', 'constraints' => [ 'depends' => [