Skip to content

Update proxy-xml.php #269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alanEG wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Update proxy-xml.php #269

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
265b490
Update proxy-xml.php
alanEG Jul 14, 2025
e4cacee
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Jul 14, 2025
425e8b0
Update proxy-xml.php
alanEG Oct 26, 2025
50519d2
Update proxy-xml.php
alanEG Oct 26, 2025
650724b
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Oct 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 30 additions & 9 deletions proxy-xml.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,36 @@
<?php
if (isset($_GET['url'])) {
$url = $_GET['url'];
<?php
$whitelist = [
'blog.freecad.org'
];

if (filter_var($url, FILTER_VALIDATE_URL)) {
$response = file_get_contents($url);
function is_url_safe($url, $whitelist) {
$parsed = parse_url($url);
if (!$parsed || !isset($parsed['host']) || !isset($parsed['scheme'])) {
return false;
}

if (!in_array($parsed['scheme'], ['http', 'https'])) {
return false;
}

$host = strtolower($parsed['host']);

if (!in_array($host, $whitelist)) {
return false;
}

return true;
}

$url = $_GET['url'] ?? '';

if (empty($url)) {
echo "No URL provided";
} elseif (is_url_safe($url, $whitelist)) {
$response = file_get_contents($url);
header('Content-Type: application/xml');
echo $response;
} else {
header("HTTP/1.1 400 Bad Request");
echo "URL not allowed";

@chennes chennes May 2, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're losing the status return here, you're going to get back a 200, even on this bad request. It would probably be better to keep it, wouldn't it?

}
} else {
header("HTTP/1.1 400 Bad Request");
}
?>