I have a server that cannot be connected to from the internet, but I need to get some info to it. I have another server that can, so I have a simple passthru script that I want to see if you all think is secure.
Basically, you hit this and if it is in the white list, it returns everything, including keeping the proper headers for Content-Type.
<?php
$domain = ( $_REQUEST['domain'] ?: '' );
$url = $_REQUEST['url'];
/** set up whitelists */
$domain_whitelist = array(
'',
'subdomain1',
'subdomain2',
'subdomain3'
);
$url_whitelist = array(
'it/myscript.php',
'scripts/add.php',
'scripts/member.php',
'scripts/status_update.php'
);
/** check REQUEST against whitelists */
if(!in_array($domain, $domain_whitelist))
diemail('Invalid domain. An email has been sent to the administrator.');
if(!in_array($url, $url_whitelist))
diemail('Invalid url. An email has been sent to the administrator.');
/** append dot to subdomain */
$domain .= ( $domain != '' ? '.' : '');
/** set up curl call */
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_URL, "http://{$domain}example.com/{$url}" );
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $_POST);
/** execute curl */
$response = curl_exec($ch);
/** handle curl response */
if($response === FALSE )
{
echo curl_error($ch);
}
else{
$header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$header_str = substr($response, 0, $header_size);
$body = substr($response, $header_size);
$headers = explode("\n",$header_str);
/** rebuild header */
foreach($headers as $header){
if( strpos($header,'Content-Type:') !== FALSE ){
header($header);
}
}
/** passthru data */
echo $body;
}