🔒 Harden external image zoom endpoint against SSRF and open reflection

- 🛡️ Require an authenticated operator session before rendering the `modal=external` image zoom view, blocking anonymous abuse of the reflection endpoint.
- ✅ Sanitize the `src` parameter with `erLhcoreClassChatValidator::sanitizeUrl()` so only http/https URLs are accepted (drops gopher/ftp/mailto/...).
- 🌐 Resolve the target host and reject loopback, private, and reserved IP ranges (e.g. 169.254.169.254) to prevent client-side SSRF probing of internal services.
- 🚫 Refuse localhost and unresolvable hostnames so attacker-controlled URLs are never reflected into `<img src>`.
- 💥 Return proper HTTP error codes (400/403) instead of silently rendering invalid input.
- ✨ Render the sanitized URL in the template rather than the raw `$_GET['src']` value.

Author: remdex

lhc_web/lib/core/lhcore/lhfileupload.php

@@ -132,7 +132,6 @@ protected function handle_file_upload($uploaded_file, $name, $size, $type, $erro
             if (function_exists('finfo_open')) {
                 $finfo = finfo_open(FILEINFO_MIME_TYPE);
                 $actualMime = finfo_file($finfo, $fileUpload->file_path_server);
-                finfo_close($finfo);
                 if ($actualMime !== false) {
                     $declaredMime = $fileUpload->type;
                     $mimeAliases = ['text/xml' => 'application/xml','application/x-rar' => 'application/x-rar-compressed', 'application/x-compressed' => 'application/x-rar-compressed', 'application/x-zip-compressed' => 'application/zip', 'image/jpg' => 'image/jpeg', 'image/pjpeg' => 'image/jpeg', 'image/x-png' => 'image/png'];

lhc_web/lib/core/lhcore/lhfileuploadadmin.php

@@ -89,7 +89,6 @@ protected function handle_file_upload($uploaded_file, $name, $size, $type, $erro
             if (function_exists('finfo_open')) {
                 $finfo = finfo_open(FILEINFO_MIME_TYPE);
                 $actualMime = finfo_file($finfo, $fileUpload->file_path_server);
-                finfo_close($finfo);
                 if ($actualMime !== false) {
                     $declaredMime = $fileUpload->type;
                     $mimeAliases = ['text/xml' => 'application/xml','application/x-rar' => 'application/x-rar-compressed', 'application/x-compressed' => 'application/x-rar-compressed', 'application/x-zip-compressed' => 'application/zip', 'image/jpg' => 'image/jpeg', 'image/pjpeg' => 'image/jpeg', 'image/x-png' => 'image/png'];

lhc_web/lib/core/lhmailconv/html_parsers/rcube_mime.php

@@ -742,7 +742,6 @@ public static function file_content_type($path, $name, $failover = 'application/
             if ($finfo) {
                 $func      = $is_stream ? 'finfo_buffer' : 'finfo_file';
                 $mime_type = $func($finfo, $path, FILEINFO_MIME_TYPE);
-                finfo_close($finfo);
             }
         }
 

lhc_web/lib/core/lhtheme/lhthemevalidator.php

@@ -146,7 +146,6 @@ public static function get_mime($file) {
         if (function_exists("finfo_file")) {
             $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension
             $mime = finfo_file($finfo, $file);
-            finfo_close($finfo);
             return $mime;
         } else if (function_exists("mime_content_type")) {
             return mime_content_type($file);

lhc_web/modules/lhabstract/downloadbinnary.php

@@ -4,7 +4,6 @@
 
 $finfo = finfo_open(FILEINFO_MIME_TYPE);
 $mimeType = finfo_file($finfo, $ObjectData->file_path_server) . "\n";
-finfo_close($finfo);
 
 header('Content-type: '.$mimeType);
 header('Content-Disposition: attachment; filename="'.$ObjectData->id.'_file_'.$ObjectData->extension.'"');

lhc_web/modules/lhfile/downloadfile.php

@@ -3,9 +3,56 @@
 try {
 
     if (isset($_GET['modal']) && $_GET['modal'] == 'external') {
+
+        // External image zoom is only used by the operator chat interface. Requiring a
+        // logged in user prevents this anonymous view from being abused to reflect an
+        // attacker supplied URL into an <img src>, which could otherwise force victims'
+        // browsers to request arbitrary/internal hosts (client side SSRF).
+        if (!erLhcoreClassUser::instance()->isLogged()) {
+            http_response_code(403);
+            exit;
+        }
+
+        // Only http/https images are allowed. This drops gopher/ftp/mailto/... and any
+        // other scheme that erLhcoreClassBBCode::esc_url() would otherwise let through.
+        $src = erLhcoreClassChatValidator::sanitizeUrl(isset($_GET['src']) ? $_GET['src'] : '');
+
+        if ($src === '') {
+            http_response_code(400);
+            exit;
+        }
+
+        // Only allow URLs pointing to an external (public) host. Resolve the host and
+        // reject loopback/private/reserved destinations so this view cannot be used to
+        // make a visitor's browser probe internal services (e.g. 169.254.169.254).
+        $srcHost = parse_url($src, PHP_URL_HOST);
+
+        if ($srcHost === null || $srcHost === false || $srcHost === '' || strtolower($srcHost) === 'localhost') {
+            http_response_code(403);
+            exit;
+        }
+
+        // Literal IPs are validated as-is; hostnames are resolved first
+        if (filter_var($srcHost, FILTER_VALIDATE_IP) !== false) {
+            $resolvedIp = $srcHost;
+        } else {
+            $resolvedIp = gethostbyname($srcHost);
+
+            if ($resolvedIp === $srcHost || filter_var($resolvedIp, FILTER_VALIDATE_IP) === false) {
+                // Host could not be resolved, do not reflect it
+                http_response_code(403);
+                exit;
+            }
+        }
+
+        if (filter_var($resolvedIp, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
+            http_response_code(403);
+            exit;
+        }
+
         $tpl = erLhcoreClassTemplate::getInstance('lhchat/zoomimage.tpl.php');
         $tpl->set('externalImage', true);
-        $tpl->set('fileImage', $_GET['src']);
+        $tpl->set('fileImage', $src);
         echo $tpl->fetch();
         exit;
     }