geturl.lib.php

Go to the documentation of this file.

<?php
/* Copyright (C) 2008-2020  Laurent Destailleur   <eldy@users.sourceforge.net>
 * Copyright (C) 2024   MDW           <mdeweerd@users.noreply.github.com>
 * Copyright (C) 2025-2026  Frédéric France         <frederic.france@free.fr>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <https://www.gnu.org/licenses/>.
 * or see https://www.gnu.org/
 */
 
function getURLContent($url, $postorget = 'GET', $param = '', $followlocation = 1, $addheaders = array(), $allowedschemes = array('http', 'https'), $localurl = 0, $ssl_verifypeer = -1, $timeoutconnect = 0, $timeoutresponse = 0, $otherCurlOptions = array(), $morelogsuffix = '')
{
  // Get global variables for proxy use
  $USE_PROXY = getDolGlobalInt('MAIN_PROXY_USE');
  $PROXY_HOST = getDolGlobalString('MAIN_PROXY_HOST');
  $PROXY_PORT = getDolGlobalInt('MAIN_PROXY_PORT');
  $PROXY_USER = getDolGlobalString('MAIN_PROXY_USER');
  $PROXY_PASS = getDolGlobalString('MAIN_PROXY_PASS');
 
  dol_syslog("getURLContent postorget=".$postorget." URL=".$url);
  if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
    dol_syslog("getURLContent postorget=".$postorget." URL=".$url." json_encode(param)=".json_encode($param), LOG_DEBUG, 0, '_curl');
  }
  if ($morelogsuffix) {
    dol_syslog("getURLContent postorget=".$postorget." URL=".$url." json_encode(param)=".json_encode($param), LOG_DEBUG, 0, $morelogsuffix);
  }
 
  if (!function_exists('curl_init')) {
    if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
      dol_syslog("getURLContent PHP curl library must be installed", LOG_DEBUG, 0, '_curl');
    }
    if ($morelogsuffix) {
      dol_syslog("getURLContent PHP curl library must be installed", LOG_DEBUG, 0, $morelogsuffix);
    }
 
    return array('http_code' => 500, 'content' => '', 'curl_error_no' => 1, 'curl_error_msg' => 'PHP curl library must be installed');
  }
 
  //setting the curl parameters.
  $ch = curl_init();
 
  /*print $API_Endpoint."-".$API_version."-".$PAYPAL_API_USER."-".$PAYPAL_API_PASSWORD."-".$PAYPAL_API_SIGNATURE."<br>";
   print $USE_PROXY."-".$gv_ApiErrorURL."<br>";
   print $nvpStr;
   exit;*/
  // The verbose output goes to the stderr of the process (Apache error log, output of a cron job...) and includes the request
  // headers with their credentials, so it is only enabled together with the curl debug log.
  curl_setopt($ch, CURLOPT_VERBOSE, getDolGlobalInt('MAIN_CURL_DEBUG') ? true : false);
  curl_setopt($ch, CURLOPT_USERAGENT, 'Dolibarr geturl function');  // set the Dolibarr user agent name
 
  // We use @ here because this may return warning if safe mode is on or open_basedir is on (following location is forbidden when safe mode is on).
  // We force value to false so we will manage redirection ourself later.
  @curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
 
  if (is_array($addheaders) && count($addheaders)) {
    curl_setopt($ch, CURLOPT_HTTPHEADER, $addheaders);
  }
  curl_setopt($ch, CURLINFO_HEADER_OUT, true); // To be able to retrieve request header and log it
 
  if (getDolGlobalInt('MAIN_CURL_GET_RESPONSE_HEADER')) {
    curl_setopt($ch, CURLOPT_HEADER, true); // To be able to retrieve response header
  }
 
  // By default use the TLS version decided by PHP.
  // You can force, if supported a version like TLSv1 or TLSv1.2
  if (getDolGlobalString('MAIN_CURL_SSLVERSION')) {
    $sslversion = is_numeric(getDolGlobalString('MAIN_CURL_SSLVERSION')) ? getDolGlobalInt('MAIN_CURL_SSLVERSION') : constant(getDolGlobalString('MAIN_CURL_SSLVERSION'));
    curl_setopt($ch, CURLOPT_SSLVERSION, (int) $sslversion);
  }
  //curl_setopt($ch, CURLOPT_SSLVERSION, 6); for tls 1.2
 
  // Turning on or off the ssl target certificate
  if ($ssl_verifypeer < 0) {
    global $dolibarr_main_prod;
    $ssl_verifypeer =  ($dolibarr_main_prod ? true : false);
  }
  if (getDolGlobalString('MAIN_CURL_DISABLE_VERIFYPEER')) {
    $ssl_verifypeer = 0;
  }
 
  // Turning off the server and peer verification(TrustManager Concept).
  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, ($ssl_verifypeer ? true : false));
 
  // 0 to not check the names
  // 1 to check the existence of a common name in the SSL peer certificate
  // 2 to check the existence of a common name and also verify that it matches the hostname provided.
  // In production environments the value of this option should be kept at 2 (default value).
  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, ($ssl_verifypeer ? 2 : 0));
 
  // Restrict use to some protocols only
  $protocols = 0;
  $redir_list = array();
  if (is_array($allowedschemes)) {
    foreach ($allowedschemes as $allowedscheme) {
      if ($allowedscheme == 'http') {
        $protocols |= CURLPROTO_HTTP;
        $redir_list["HTTP"] = 1;
      } elseif ($allowedscheme == 'https') {
        $protocols |= CURLPROTO_HTTPS;
        $redir_list["HTTPS"] = 1;
      } elseif ($allowedscheme == 'ftp') {
        $protocols |= CURLPROTO_FTP;
        $redir_list["FTP"] = 1;
      } elseif ($allowedscheme == 'ftps') {
        $protocols |= CURLPROTO_FTPS;
        $redir_list["FTPS"] = 1;
      }
    }
  } else {
    return array('http_code' => 500, 'content' => '', 'curl_error_no' => 1, 'curl_error_msg' => 'Parameter allowedschemes of getURLContent must be an array of protocol schemes');
  }
 
  $newtimeoutconnect = ($timeoutconnect ? $timeoutconnect : getDolGlobalInt('MAIN_USE_CONNECT_TIMEOUT', 5));
  $newtimeoutresponse = ($timeoutresponse ? $timeoutresponse : getDolGlobalInt('MAIN_USE_RESPONSE_TIMEOUT', 30));
 
  if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
    dol_syslog("getURLContent newtimeoutconnect=".$newtimeoutconnect." newtimeoutresponse=".$newtimeoutresponse, LOG_DEBUG, 0, '_curl');
  }
  if ($morelogsuffix) {
    dol_syslog("getURLContent newtimeoutconnect=".$newtimeoutconnect." newtimeoutresponse=".$newtimeoutresponse, LOG_DEBUG, 0, $morelogsuffix);
  }
 
  curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $newtimeoutconnect); // Timeout for connection
  curl_setopt($ch, CURLOPT_TIMEOUT, $newtimeoutresponse);     // Timeout for total time including connection
 
  // limit size of downloaded files.
  $maxsize = getDolGlobalInt('MAIN_SECURITY_MAXFILESIZE_DOWNLOADED');
  if ($maxsize && defined('CURLOPT_MAXFILESIZE_LARGE')) {
    curl_setopt($ch, CURLOPT_MAXFILESIZE_LARGE, $maxsize * 1024);  // @phan-suppress-current-line PhanTypeMismatchArgumentNullableInternal
  }
  if ($maxsize && defined('CURLOPT_MAXFILESIZE')) {
    curl_setopt($ch, CURLOPT_MAXFILESIZE, $maxsize * 1024);
  }
 
  //curl_setopt($ch, CURLOPT_SAFE_UPLOAD, true);  // PHP 5.5
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // We want response
 
  // Accept a compressed response (gzip, deflate, br... whatever this libcurl supports): libcurl decodes it, so 'content' is the
  // plain body. Note that the response headers (HEAD, MAIN_CURL_GET_RESPONSE_HEADER) still show the Content-Encoding.
  curl_setopt($ch, CURLOPT_ENCODING, '');
 
  $responsebuffer = '';
  $responsetoolarge = false;
  if ($maxsize) {
    // CURLOPT_MAXFILESIZE counts the bytes received on the wire, so a compressed response can decode into much more than the
    // limit: the decoded bytes are counted too, and the transfer is aborted as soon as they exceed the limit.
    $writefunction = function ($curl, $data) use (&$responsebuffer, &$responsetoolarge, $maxsize) {
      if (strlen($responsebuffer) + strlen($data) > $maxsize * 1024) {
        $responsetoolarge = true;
        return 0; // Less than strlen($data): libcurl aborts the transfer with CURLE_WRITE_ERROR (23)
      }
      $responsebuffer .= $data;
      return strlen($data);
    };
    curl_setopt($ch, CURLOPT_WRITEFUNCTION, $writefunction);
  }
  if ($postorget == 'POST') {
    curl_setopt($ch, CURLOPT_POST, true); // POST
    curl_setopt($ch, CURLOPT_POSTFIELDS, $param); // Setting param x=a&y=z as POST fields
  } elseif ($postorget == 'POSTALREADYFORMATED') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST'); // HTTP request is 'POST' but param string is taken as it is
    curl_setopt($ch, CURLOPT_POSTFIELDS, $param); // param = content of post, like a xml string
  } elseif ($postorget == 'PUT') {
    $array_param = array();
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT'); // HTTP request is 'PUT'
    if (!is_array($param)) {
      parse_str($param, $array_param);
    } else {
      dol_syslog("parameter param must be a string", LOG_WARNING);
      $array_param = $param;
    }
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($array_param)); // Setting param x=a&y=z as PUT fields
  } elseif ($postorget == 'PUTALREADYFORMATED') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT'); // HTTP request is 'PUT'
    curl_setopt($ch, CURLOPT_POSTFIELDS, $param); // param = content of post, like a xml string
  } elseif ($postorget == 'PATCH') {
    $array_param = array();
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PATCH'); // RFC 5789
    if (!is_array($param)) {
      parse_str($param, $array_param);
    } else {
      dol_syslog("parameter param must be a string", LOG_WARNING);
      $array_param = $param;
    }
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($array_param));
  } elseif ($postorget == 'PATCHALREADYFORMATED') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PATCH'); // RFC 5789
    curl_setopt($ch, CURLOPT_POSTFIELDS, $param);
  } elseif ($postorget == 'HEAD') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'HEAD'); // HTTP request is 'HEAD'
    curl_setopt($ch, CURLOPT_NOBODY, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
  } elseif ($postorget == 'DELETE') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE'); // POST
  } else {
    curl_setopt($ch, CURLOPT_POST, false); // GET
  }
 
  //if USE_PROXY constant set at begin of this method.
  if ($USE_PROXY) {
    dol_syslog("getURLContent set proxy to ".$PROXY_HOST.":".$PROXY_PORT." - ".$PROXY_USER.":".$PROXY_PASS);
    //curl_setopt ($ch, CURLOPT_PROXYTYPE, CURLPROXY_HTTP); // Curl 7.10
    curl_setopt($ch, CURLOPT_PROXY, $PROXY_HOST.":".$PROXY_PORT);
    if ($PROXY_USER) {
      curl_setopt($ch, CURLOPT_PROXYUSERPWD, $PROXY_USER.":".$PROXY_PASS);
    }
  }
 
  if (is_array($otherCurlOptions)) {
    // Options that would bypass the anti SSRF check done below on each hop (redirections are followed by hand so that every hop
    // is checked, and the connection is pinned to the IP that was checked): they are ignored whatever the caller asks.
    $forbiddencurloptions = [CURLOPT_FOLLOWLOCATION, CURLOPT_URL, CURLOPT_RESOLVE, CURLOPT_PROXY, CURLOPT_PROTOCOLS, CURLOPT_REDIR_PROTOCOLS];
    foreach (['CURLOPT_CONNECT_TO', 'CURLOPT_UNIX_SOCKET_PATH', 'CURLOPT_ABSTRACT_UNIX_SOCKET', 'CURLOPT_PRE_PROXY'] as $constname) {
      if (defined($constname)) {
        $forbiddencurloptions[] = constant($constname);
      }
    }
    foreach ($otherCurlOptions as $option => $value) {
      if (in_array($option, $forbiddencurloptions, true)) {
        dol_syslog("getURLContent curl option ".$option." can not be set with otherCurlOptions, ignored", LOG_WARNING);
        continue;
      }
      curl_setopt($ch, $option, $value);
    }
  }
 
  $newUrl = $url;
  $maxRedirection = 5;
  $info = array();
  $response = '';
 
  do {
    if ($maxRedirection < 1) {
      if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
        dol_syslog("getURLContent http_code=400 Maximum number of redirections reached", LOG_DEBUG, 0, '_curl');
      }
      return array('http_code' => 400, 'content' => 'Maximum number of redirections reached', 'curl_error_no' => 1, 'curl_error_msg' => 'Maximum number of redirections reached');
    }
 
    curl_setopt($ch, CURLOPT_URL, $newUrl);
 
    // Parse $newUrl
    $newUrlArray = parse_url($newUrl);
    if (!is_array($newUrlArray) || (empty($newUrlArray['host']) && empty($newUrlArray['path']))) {
      // parse_url() returns false on a malformed URL (like 'http:///path')
      return array('http_code' => 400, 'content' => '', 'curl_error_no' => 1, 'curl_error_msg' => 'Bad URL '.$newUrl);
    }
    $hosttocheck = !empty($newUrlArray['host']) ? $newUrlArray['host'] : $newUrlArray['path'];
    $hosttocheck = str_replace(array('[', ']'), '', $hosttocheck); // Remove brackets of IPv6
 
    // Deny some reserved host names
    if (in_array(strtolower($hosttocheck), array('metadata.google.internal'))) {
      $info['http_code'] = 400;
      $info['content'] = 'Error bad hostname '.$hosttocheck.' (Used by Google metadata). This value for hostname is not allowed.';
      if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
        dol_syslog("getURLContent http_code=400 ".$info['content'], LOG_DEBUG, 0, '_curl');
      }
      return array('http_code' => 400, 'content' => $info['content'], 'curl_error_no' => 1, 'curl_error_msg' => $info['content']);
    }
 
    // Discard a host name that is a plain integer (decimal like 2130706433, hex like 0x7f000001, octal like 017700000001): the
    // gethostbyname() fallback of resolveDns() would turn it into an IP (127.0.0.1 for these three) while it is not a host name.
    // Only integers are refused: a single label host name made of hex letters, like 'db' or 'cafe', is a legitimate host name.
    if (preg_match('/^(0x[0-9a-f]+|[0-9]+)$/i', $hosttocheck)) {
      return array('http_code' => 400, 'content' => '', 'curl_error_no' => 1, 'curl_error_msg' => 'Host is a numeric address that is not allowed');
    }
 
    // Clean host name $hosttocheck to convert it into an IP $iptocheck
    if (filter_var($hosttocheck, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6)) {
      $iptocheck = $hosttocheck;  // Already an IP (v4, or v6 without its brackets), nothing to resolve
    } elseif (in_array($hosttocheck, array('localhost', 'localhost.domain'))) {
      $iptocheck = '127.0.0.1';
    } elseif (in_array($hosttocheck, array('ip6-localhost', 'ip6-loopback'))) {
      $iptocheck = '::1';
    } else {
      // Resolve $hosttocheck to get the IP $iptocheck
      $iptocheck = resolveDns($hosttocheck);
    }
 
    // Check $iptocheck is an IP (v4 or v6). resolveDns() returns the host name itself when the resolution failed.
    if (!filter_var($iptocheck, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6)) { // This is not an IP
      return array('http_code' => 400, 'content' => '', 'curl_error_no' => 1, 'curl_error_msg' => 'Host '.$hosttocheck.' can not be resolved into an IP');
    }
 
    if ($iptocheck) {
      $tmpresult = isIPAllowed($iptocheck, $localurl);
      if ($tmpresult) {
        $info['http_code'] = 400;
        $info['content'] = $tmpresult;
        if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
          dol_syslog("getURLContent http_code=400 ".$info['content'], LOG_DEBUG, 0, '_curl');
        }
        return array('http_code' => 400, 'content' => $tmpresult, 'curl_error_no' => 1, 'curl_error_msg' => $tmpresult);
      }
    }
 
    if ($iptocheck) {
      // Set CURLOPT_CONNECT_TO so curl will not try another resolution that may give a different result. Possible only on PHP v7+
      // Format is "host:port:ip:port". Port fields MUST use %s, not %d: an empty port (default 80/443) must stay empty so it matches "any port" and pins to the same port. With %d the empty string becomes 0 ("host:0:ip:0"), never matches the real port, and libcurl ignores the pin, re-opening a DNS-rebinding SSRF bypass.
      if (defined('CURLOPT_CONNECT_TO')) {
        // An IPv6 must be in brackets, like in a URL, else libcurl can not tell it from the port separators ("host:80:::1:80" fails with "No valid port number in connect to host string").
        $ipforconnect = (strpos($iptocheck, ':') !== false) ? '['.$iptocheck.']' : $iptocheck;
        $connect_to = array(sprintf("%s:%s:%s:%s", $newUrlArray['host'], empty($newUrlArray['port']) ? '' : $newUrlArray['port'], $ipforconnect, empty($newUrlArray['port']) ? '' : $newUrlArray['port']));
        //var_dump($newUrlArray);
        //var_dump($connect_to);
        curl_setopt($ch, CURLOPT_CONNECT_TO, $connect_to);
      }
    }
 
    // Moving these just before the curl_exec option really limits
    // on windows PHP 7.4.
    curl_setopt($ch, CURLOPT_PROTOCOLS, $protocols);
    curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS, $protocols);
    /* CURLOPT_REDIR_PROTOCOLS_STR available from PHP 7.85.0
    if (version_compare(PHP_VERSION, '8.3.0', '>=') && version_compare(curl_version()['version'], '7.85.0', '>=')) {
      curl_setopt($ch, CURLOPT_REDIR_PROTOCOLS_STR, implode(",", array_keys($redir_list)));
    }
    */
 
    // Getting response from server
    $responsebuffer = '';
    $responsetoolarge = false;
    $response = curl_exec($ch);   // return false on error, result on success
    if ($maxsize) {
      // With a write function, curl_exec() returns true instead of the response: the response is what the function collected
      $response = ($response === false || $responsetoolarge) ? false : $responsebuffer;
    }
 
    $info = curl_getinfo($ch); // Reading of request must be done after sending request
    $http_code = $info['http_code'];
 
    if ($followlocation && in_array($http_code, [301, 302, 303, 307, 308]) && !empty($info['redirect_url'])) {
      $newUrl = $info['redirect_url'];
      $maxRedirection--;
 
      // Redirections are followed by hand, so that every hop goes through the anti SSRF check above, which means the options set
      // before this loop are still there for the next hop. When libcurl follows a redirection itself, it does not send the
      // Authorization header to another host and it turns a POST into a GET on 301/302/303: do the same here.
      $currenthost = (is_array($newUrlArray) && !empty($newUrlArray['host'])) ? $newUrlArray['host'] : '';
      $nexthost = (string) parse_url($newUrl, PHP_URL_HOST);
      if (strtolower($nexthost) != strtolower($currenthost)) {
        // The credentials were meant for the host that was called, not for the one it redirects to.
        $addheaders = removeCredentialHeaders($addheaders);
        curl_setopt($ch, CURLOPT_HTTPHEADER, $addheaders);
      }
      if (in_array($http_code, [301, 302, 303]) && !in_array($postorget, ['GET', 'HEAD'])) {
        // Same as libcurl and browsers: the redirected request is a GET without the body of the POST/PUT/PATCH.
        $postorget = 'GET';
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, null);
        curl_setopt($ch, CURLOPT_HTTPGET, true);
      }
      continue;
    }
 
    $http_code = 0;
  } while ($http_code); // Stop if http_code is 0
 
  $request = curl_getinfo($ch, CURLINFO_HEADER_OUT); // Reading of request must be done after sending request
 
  dol_syslog("getURLContent request without content body=".$request);
  if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
    // This may contains binary data, so we don't output response by default.
    dol_syslog("getURLContent request without body=".$request, LOG_DEBUG, 0, '_curl');
    dol_syslog("getURLContent response=".$response, LOG_DEBUG, 0, '_curl');
  }
  if ($morelogsuffix) {
    // This may contains binary data, so we don't output response by default.
    dol_syslog("getURLContent request without body=".$request, LOG_DEBUG, 0, $morelogsuffix);
    dol_syslog("getURLContent response=".$response, LOG_DEBUG, 0, $morelogsuffix);
  }
 
  dol_syslog("getURLContent response size=".strlen($response)); // This $response may contains binary data, so we don't output it
 
  $rep = array();
  if (curl_errno($ch)) {
    // Add keys to $rep
    if ($response) {
      $rep['content'] = (string) $response;
    } else {
      $rep['content'] = '';
    }
 
    $rep['http_code'] = 0;
    $rep['curl_error_no'] = curl_errno($ch);
    $rep['curl_error_msg'] = curl_error($ch);
    if ($responsetoolarge) {
      // The transfer was aborted by our write function (error 23): report it like libcurl does for its own size check
      $rep['curl_error_no'] = 63; // CURLE_FILESIZE_EXCEEDED
      $rep['curl_error_msg'] = 'Maximum file size exceeded';
    }
 
    dol_syslog("getURLContent response array is ".implode(',', $rep));
 
    if (getDolGlobalInt('MAIN_CURL_DEBUG')) {
      dol_syslog("getURLContent curl_error_no=".$rep['curl_error_no']." curl_error_msg=".$rep['curl_error_msg'], LOG_DEBUG, 0, '_curl');
    }
    if ($morelogsuffix) {
      dol_syslog("getURLContent curl_error_no=".$rep['curl_error_no']." curl_error_msg=".$rep['curl_error_msg'], LOG_DEBUG, 0, $morelogsuffix);
    }
  } else {
    //$info = curl_getinfo($ch);
 
    // Return all fields found into $info.
    $rep = $info;
    //$rep['header_size'] = $info['header_size'];
    //$rep['http_code'] = $info['http_code'];
    //$rep['content_type'] = $info['http_code'];
 
    dol_syslog("getURLContent http_code=".$rep['http_code']);
 
    // Add more keys to $rep
    if ($response) {
      $rep['content'] = (string) $response;
      if ($postorget == 'HEAD' || getDolGlobalInt('MAIN_CURL_GET_RESPONSE_HEADER')) { // In this case, response contains header + body
        $rep['header'] = substr($rep['content'], 0, intval($rep['header_size']));
        $rep['content'] = substr($rep['content'], intval($rep['header_size']));
      }
    } else {
      $rep['content'] = '';
    }
 
    $rep['curl_error_no'] = 0;
    $rep['curl_error_msg'] = '';
  }
 
  //closing the curl
  curl_close($ch);
 
  // We must exclude phpstant wwarning, because all fields found in result of curl_getinfo may not be all defined into description of this method.
  // @phpstan-ignore-next-line
  return $rep;
}
 
function removeCredentialHeaders($headers)
{
  if (!is_array($headers)) {
    return [];
  }
 
  $credentialheaders = ['authorization', 'proxy-authorization', 'cookie', 'x-api-key', 'api-key', 'apikey', 'x-auth-token', 'x-access-token', 'x-goog-api-key', 'dolapikey'];
 
  $ret = [];
  foreach ($headers as $header) {
    $name = strtolower(trim((string) strstr((string) $header, ':', true)));
    if (in_array($name, $credentialheaders)) {
      continue;
    }
    $ret[] = $header;
  }
 
  return $ret;
}
 
 
function resolveDns($hosttocheck)
{
  $iptocheck = null;
 
  // Resolve $hosttocheck to get the IP $iptocheck
  if (function_exists('dns_get_record') && !getDolGlobalString('MAIN_DISABLE_DNS_GET_RECORD_FOR_IP_RESOLUTION')) {
    try {
      // A failed resolution (host not found, DNS server failure) raises a PHP warning, that we silence: the caller handles the "not resolved" case.
      // The try/catch is still needed when an error handler converts warnings into exceptions (the @ does not prevent that).
      $records = @dns_get_record($hosttocheck, DNS_A + DNS_AAAA);
 
      if (!empty($records[0]) && is_array($records[0]) && !empty($records[0]['ip'])) {      // We take the first one
        $iptocheck = $records[0]['ip'];
      } elseif (!empty($records[0]) && is_array($records[0]) && !empty($records[0]['ipv6'])) {  // We take the first one
        $iptocheck = $records[0]['ipv6'];
      }
    } catch (Exception $e) {
      // Nothing done
    }
  } elseif (function_exists('gethostbyname')) { // resolve only ipv4
    $iptocheck = gethostbyname($hosttocheck);
  } else {
    $iptocheck = $hosttocheck;
  }
 
  if ($iptocheck === null) {
    $iptocheck = $hosttocheck;
  }
  return $iptocheck;
}
 
 
function isIPAllowed($iptocheck, $localurl)
{
  if ($localurl == 0) { // Only external url allowed (dangerous, may allow to get malware)
    if (!filter_var($iptocheck, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
      // Deny ips like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 0.0.0.0/8, 169.254.0.0/16, 127.0.0.0/8 et 240.0.0.0/4, ::1/128, ::/128, ::ffff:0:0/96, fe80::/10...
      $errormsg = 'Error bad hostname IP (private or reserved range). Must be an external URL.';
      return $errormsg;
    }
    if (!empty($_SERVER["SERVER_ADDR"]) && $iptocheck == $_SERVER["SERVER_ADDR"]) {
      $errormsg = 'Error bad hostname IP (IP is a local IP). Must be an external URL.';
      return $errormsg;
    }
    if (getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP') && in_array($iptocheck, explode(',', getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP')))) {
      $errormsg = 'Error bad hostname IP (IP is a local IP defined into MAIN_SECURITY_SERVER_IP). Must be an external URL.';
      return $errormsg;
    }
  }
  if ($localurl == 1) { // Only local url allowed (dangerous, may allow to get metadata on server or make internal port scanning)
    // Deny ips NOT like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 0.0.0.0/8, 169.254.0.0/16, 127.0.0.0/8 et 240.0.0.0/4, ::1/128, ::/128, ::ffff:0:0/96, fe80::/10...
    if (filter_var($iptocheck, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
      $errormsg = 'Error bad hostname '.$iptocheck.'. Must be a local URL.';
      return $errormsg;
    }
    if (getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP') && !in_array($iptocheck, explode(',', getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP')))) {
      $errormsg = 'Error bad hostname IP (IP is not a local IP defined into list MAIN_SECURITY_SERVER_IP). Must be a local URL in allowed list.';
      return $errormsg;
    }
  }
 
  // Common check on ip (local and external)
  // See list on https://tagmerge.com/gist/a7b9d57ff8ec11d63642f8778609a0b8
  // Not evasive url that ar enot IP are excluded by test on IP v4/v6 validity.
  // The link-local ones are already refused above when only external URLs are allowed, but not when local URLs are ($localurl = 1
  // or 2), and 168.63.129.16 is in the public address space anyway.
  $arrayofmetadataserver = array(
    '169.254.169.254' => 'AWS, GCP, Azure, OpenStack, DigitalOcean...',
    'fd00:ec2::254' => 'AWS (IPv6)',
    '169.254.170.2' => 'AWS ECS',
    '168.63.129.16' => 'Azure',
    '100.100.100.200' => 'Alibaba',
    '192.0.0.192' => 'Oracle',
    '192.80.8.124' => 'Packet',
    '100.88.222.5' => 'Tencent cloud',
  );
  foreach ($arrayofmetadataserver as $ipofmetadataserver => $nameofmetadataserver) {
    if ($iptocheck == $ipofmetadataserver) {
      $errormsg = 'Error bad hostname IP (Used by '.$nameofmetadataserver.' metadata server). This IP is forbidden.';
      return $errormsg;
    }
  }
 
  return '';
}
 
function getDomainFromURL($url, $mode = 0)
{
  $arrayof2levetopdomain = array(
    'co.at', 'or.at', 'gv.at',
    'avocat.fr', 'aeroport.fr', 'veterinaire.fr',
    'com.ng', 'gov.ng', 'gov.ua', 'com.ua', 'in.ua', 'org.ua', 'edu.ua', 'net.ua',
    'net.uk', 'org.uk', 'gov.uk', 'co.uk',
    'com.mx'
  );
 
  // Set if tld is on 2 levels
  $tldon2level = 0;
  $parts = array_reverse(explode('.', $url));
  if (!empty($parts[1]) && in_array($parts[1].'.'.$parts[0], $arrayof2levetopdomain)) {
    $tldon2level = 1;
  }
 
  if ($tldon2level && $mode > 0) {
    $mode++;
  }
 
  $tmpdomain = preg_replace('/^https?:\/\/[^:]+:[^@]+@/i', '', $url);   // Remove http(s)://login@pass in https://login@pass:mydomain.com/path, so we now got mydomain.com/path
  $tmpdomain = preg_replace('/^https?:\/\//i', '', $tmpdomain);       // Remove http(s)://
  $tmpdomain = preg_replace('/\/.*$/i', '', $tmpdomain);          // Remove part after /
  $tmpdomain = preg_replace('/^[^@]+@/i', '', $tmpdomain);        // Remove part1@ in part1@part2 (for emails)
  if ($mode == 3) {
    $tmpdomain = preg_replace('/^.*\.([^\.]+)\.([^\.]+)\.([^\.]+)\.([^\.]+)$/', '\1.\2.\3.\4', $tmpdomain);
  } elseif ($mode == 2) {
    $tmpdomain = preg_replace('/^.*\.([^\.]+)\.([^\.]+)\.([^\.]+)$/', '\1.\2.\3', $tmpdomain); // Remove part 'www.' before 'abc.mydomain.com'
  } elseif ($mode == 1) {
    $tmpdomain = preg_replace('/^.*\.([^\.]+)\.([^\.]+)$/', '\1.\2', $tmpdomain); // Remove part 'www.abc.' before 'mydomain.com'
  }
 
  if (empty($mode)) {
    if ($tldon2level) {
      $tmpdomain = preg_replace('/^.*\.([^\.]+)\.([^\.]+)\.([^\.]+)$/', '\1.\2.\3', $tmpdomain); // Remove part 'www.abc.' before 'mydomain.com'
      $tmpdomain = preg_replace('/\.[^\.]+\.[^\.]+$/', '', $tmpdomain); // Remove TLD (.com.mx, .co.uk, ...)
    } else {
      $tmpdomain = preg_replace('/^.*\.([^\.]+)\.([^\.]+)$/', '\1.\2', $tmpdomain); // Remove part 'www.abc.' before 'mydomain.com'
      $tmpdomain = preg_replace('/\.[^\.]+$/', '', $tmpdomain); // Remove TLD (.com, .net, ...)
    }
  }
 
  return $tmpdomain;
}
 
function getRootURLFromURL($url)
{
  return preg_replace('/^([a-z]*:\/\/[^\/]*).*/i', '$1', $url);
}
 
function removeHtmlComment($content)
{
  $content = preg_replace('/<!--[^\-]+-->/', '', $content);
  return $content;
}