Merge pull request phpbb#3550 from bantu/ticket/13765-3.1.4

[ticket/13765] Verify SERVER_PROTOCOL has the expected format before using it. * bantu/ticket/13765-3.1.4: [ticket/13765] Verify SERVER_PROTOCOL has the expected format before using it.
agothro · Apr 25, 2015 · eae5926 · eae5926
2 parents 073f3e4 + 901875a
commit eae5926
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
@@ -2544,13 +2544,19 @@ function phpbb_request_http_version()
 {
 	global $request;
 
+	$version = '';
 	if ($request && $request->server('SERVER_PROTOCOL'))
 	{
-		return $request->server('SERVER_PROTOCOL');
+		$version = $request->server('SERVER_PROTOCOL');
 	}
 	else if (isset($_SERVER['SERVER_PROTOCOL']))
 	{
-		return $_SERVER['SERVER_PROTOCOL'];
+		$version = $_SERVER['SERVER_PROTOCOL'];
+	}
+
+	if (!empty($version) && is_string($version) && preg_match('#^HTTP/[0-9]\.[0-9]$#', $version))
+	{
+		return $version;
 	}
 
 	return 'HTTP/1.0';