fetch_file_contents: resolve requested hosts and check for possible

loopback address

1 files changed, 7 insertions, 0 deletions

diff --git a/include/functions.php b/include/functions.php
index 508801fb7..4ef734218 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -243,6 +243,13 @@
 		if (!$url) return false;
 
 		$url_host = parse_url($url, PHP_URL_HOST);
+		$ip_addr = gethostbyname($url_host);
+
+		if (!$ip_addr || strpos($ip_addr, "127.0") === 0) {
+			$fetch_last_error = "URL hostname failed to resolve or resolved to loopback address ($ip_addr)";
+			return false;
+		}
+
 		$fetch_domain_hits[$url_host] += 1;
 
 		/*if ($fetch_domain_hits[$url_host] > MAX_FETCH_REQUESTS_PER_HOST) {