Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

SA-CORE-2022-015 by Heine, larowlan, alexpott, samuel.mortenson, xjm, pandaski, vijaycs85, effulgentsia, drumm, benjifisher, jenlampton, longwave 

(cherry picked from commit 3ad2b64c09)
merge-requests/2501/merge
xjm 2022-07-20 10:11:31 -05:00
parent ec39795b28
commit bd43f4aef9
No known key found for this signature in database
GPG Key ID: 206B0B8743BDF4C2
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
core/modules/media/src/Controller/OEmbedIframeController.php
View File

@ -116,10 +116,23 @@ class OEmbedIframeController implements ContainerInjectionInterface {
* The response object.
*
* @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
* Will be thrown if the 'hash' parameter does not match the expected hash
* of the 'url' parameter.
* Will be thrown if either
* - the 'hash' parameter does not match the expected hash of the 'url'
* parameter;
* - the iframe_domain is set in media.settings and does not match the host
* in the request.
*/
public function render(Request $request) {
// @todo Move domain check logic to a separate method.
$allowed_domain = \Drupal::config('media.settings')->get('iframe_domain');
if ($allowed_domain) {
$allowed_host = parse_url($allowed_domain, PHP_URL_HOST);
$host = parse_url($request->getSchemeAndHttpHost(), PHP_URL_HOST);
if ($allowed_host !== $host) {
throw new AccessDeniedHttpException('This resource is not available');
}
}
$url = $request->query->get('url');
$max_width = $request->query->getInt('max_width');
$max_height = $request->query->getInt('max_height');