{"action":"opened","issue":{"url":"https://api.github.com/repos/AtvirasAlus/Atviras-Alus/issues/1","labels_url":"https://api.github.com/repos/AtvirasAlus/Atviras-Alus/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/AtvirasAlus/Atviras-Alus/issues/1/comments","events_url":"https://api.github.com/repos/AtvirasAlus/Atviras-Alus/issues/1/events","html_url":"https://github.com/AtvirasAlus/Atviras-Alus/issues/1","id":110985350,"number":1,"title":"getfeed.php - security issues","user":{"login":"klodoma","id":944350,"avatar_url":"https://avatars.githubusercontent.com/u/944350?v=3","gravatar_id":"","url":"https://api.github.com/users/klodoma","html_url":"https://github.com/klodoma","followers_url":"https://api.github.com/users/klodoma/followers","following_url":"https://api.github.com/users/klodoma/following{/other_user}","gists_url":"https://api.github.com/users/klodoma/gists{/gist_id}","starred_url":"https://api.github.com/users/klodoma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/klodoma/subscriptions","organizations_url":"https://api.github.com/users/klodoma/orgs","repos_url":"https://api.github.com/users/klodoma/repos","events_url":"https://api.github.com/users/klodoma/events{/privacy}","received_events_url":"https://api.github.com/users/klodoma/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-12T14:29:54Z","updated_at":"2015-10-12T14:29:54Z","closed_at":null,"body":"The code from getfeed.php is very unsafe.\r\n\r\n```javascript\r\n<?php\r\nheader('Content-type: text/xml; charset=utf-8');\r\n$url = htmlspecialchars($_GET['url']);\r\necho file_get_contents('http://'.$url,0); ?>\r\n``` \r\nthis allows a hacker to make ANY GET request look like an internal/local request. \r\n\r\nIn case you have an active firewall and that identifies a HTTP request like \"suspicios\" your own server will get blacklisted in your own firewall. This also means, all these requests get blocked... \r\n\r\nIt just happened."}}