Disallow ports or non-http(s) schemes

umbrae · Aug 11, 2015 · 42d43ee · 42d43ee
1 parent f8b1ea8
commit 42d43ee
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/proxy.php b/proxy.php
@@ -4,6 +4,14 @@
 
 if (!$url || !preg_match("/^https?:/i", $url)) {
     echo '{ "result": "Invalid URL. Please check your URL and try again.", "error": true }';
+    return;
+}
+
+$parsed_url = parse_url($url);
+$scheme = strtolower($parsed_url['scheme']);
+if (array_key_exists('port', $parsed_url) || ($scheme !== "http" && $scheme !== "https")) {
+    echo '{ "result": "Invalid URL - Please check your URL and try again.", "error": true }';
+    return;
 }
 
 $ch = curl_init($url);