DMZ passthru script

Question

I have a server that cannot be connected to from the internet, but I need to get some info to it. I have another server that can, so I have a simple passthru script that I want to see if you all think is secure.

Basically, you hit this and if it is in the white list, it returns everything, including keeping the proper headers for Content-Type.

<?php

$domain = ( $_REQUEST['domain'] ?: '' ); 
$url    = $_REQUEST['url'];

/** set up whitelists */
$domain_whitelist = array(
    '',
    'subdomain1',
    'subdomain2',
    'subdomain3'
);

$url_whitelist = array(
    'it/myscript.php',
    'scripts/add.php',
    'scripts/member.php',
    'scripts/status_update.php'
);

/** check REQUEST against whitelists */
if(!in_array($domain, $domain_whitelist))
    diemail('Invalid domain. An email has been sent to the administrator.');

if(!in_array($url, $url_whitelist))
    diemail('Invalid url. An email has been sent to the administrator.');

/** append dot to subdomain */
$domain .= ( $domain != '' ? '.' : '');

/** set up curl call */
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_URL, "http://{$domain}example.com/{$url}" );
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $_POST);

/** execute curl */
$response = curl_exec($ch);

/** handle curl response */
if($response === FALSE )
{
    echo curl_error($ch);
}
else{ 
    $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $header_str = substr($response, 0, $header_size);
    $body = substr($response, $header_size);

    $headers = explode("\n",$header_str);

    /** rebuild header */
    foreach($headers as $header){
        if( strpos($header,'Content-Type:') !== FALSE ){ 
            header($header);
        }
    }
    /** passthru data */
    echo $body;
}

Answer 1

Your code looks nice, but it could be improved upon:

1. $domain != '' ? '.' : ''; With ternaries in PHP, if you don't need one of two results, you can reverse the if condition and use ?:.

   $domain == '' ?: '.'
   

2. You should make sure you leave whitespace before and after your binary operators and in particular, your comma in explode("\n",$header_str), but don't add extra whitespace in your if-else statement, between the brackets.

3. If you're interested in ternaries, you can condense the following into a ternary by reversing the condition and using ?::

if(strpos($header,'Content-Type:') !== FALSE){ 
    header($header);
}

into: strpos($header,'Content-Type:') === FALSE ?: header($header);

4. Your comments are formatted incorrectly:

/** passthru data */ should be // Pass through data, and you shouldn't use /* */ for single line comments, and you even have an superfluous * after /*.

/* */ is for multiline comments, and only then would you use a * per line.