I'm using code which is giving me problems to get a picture using CURL.
public function getRemoteFile($url, $dest, $authmode = null, $cookies = null)
{
$context = $this->createContext($url);
$ch=$context['curlhandle'];
$dl_opts = $context['opts']['dl'];
$outname = $dest;
if ($cookies)
{
if (substr($url, 0, 4) == "http")
{
$dl_opts[CURLOPT_COOKIE] = $cookies;
}
}
$fp = fopen($outname, "w");
if ($fp == false)
{
$this->destroyContext($context);
throw new Exception("Cannot write file:$outname");
}
$dl_opts[CURLOPT_FILE] = $fp;
$this->setURLOptions($url, $dl_opts);
$this->setAuthOptions($context,$dl_opts);
// Download the file , force expect to nothing to avoid buffer save problem
curl_setopt_array($ch, $dl_opts);
$inf = curl_getinfo($ch);
if (!curl_exec($ch))
{
if (curl_error($ch) != "")
{
$err = "Cannot fetch $url :" . curl_error($ch);
}
else
{
$err = "CURL Error downloading $url";
}
$this->destroyContext($context);
fclose($fp);
unlink($dest);
throw new Exception($err);
}
else
{
$proto=$context['scheme'];
if($proto=='http' || $proto=='https')
{
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$ok = ($httpCode < 400);
if(!$ok)
{
fclose($fp);
@unlink($outname);
throw new Exception('Cannot fetch URL :'.$url);
}
}
}
fclose($fp);
$this->destroyContext($context);
return true;
}
And I'm getting this output:
Warning: curl_setopt_array(): CURLOPT_FOLLOWLOCATION cannot be activated when safe_mode is enabled or an open_basedir is set in /usr/home/shop.domain.com/web/productimport/inc/remotefilegetter.php on line 290
I also tried to see what do i get on $dl_opts Because error starts when I call:
curl_setopt_array($ch, $dl_opts);
So inside $dl_opts I got:
Array ( [80] => 1 [42] => 0 [44] => 0 [52] => 1 [10023] => Array ( [0] => Expect: ) [19913] => [19914] => 1 [10001] => Resource id #261 [10002] => http://domain/picture/static/l0033.jpg )
INFO:
Apparently, allowing 301 and 302 redirects with CURLOPT_FOLLOWLOCATION would follow redirects to file:// URLs. (found this commit to PHP sources: https://github.com/php/php-src/commit/fba290c061027c24e4c8effdba37addd3430c3d4 )
If redirects to file:// URLs are allowed, whoever controls the originally requested URL can make your PHP script fetch a file from your server's local disk instead. A web service that get a URL from an user and shows the contents could then be used to read any file from server's disk that's accessible to PHP.
Solutions: