From a46e9c64a22224375b21148d5bfc5f4dc4b35844 Mon Sep 17 00:00:00 2001
From: para <157126561+mdegallaix@users.noreply.github.com>
Date: Fri, 25 Sep 2026 22:19:36 +0200
Subject: [PATCH] Harden PHP feeds: block direct cache access, cap curl
 redirects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security review found no exploitable issue — none of the 3 endpoints
accept user input, so there's no injection surface (upstream URLs are
hardcoded constants, output is XML-escaped). These are defense-in-depth
only: deny direct HTTP access to cache/, and cap CURLOPT_MAXREDIRS to
avoid a hung request on a misbehaving upstream.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 php/cache/.htaccess | 3 +++
 php/common.php      | 1 +
 2 files changed, 4 insertions(+)
 create mode 100644 php/cache/.htaccess

diff --git a/php/cache/.htaccess b/php/cache/.htaccess
new file mode 100644
index 0000000..6fed7bd
--- /dev/null
+++ b/php/cache/.htaccess
@@ -0,0 +1,3 @@
+# Empeche l'acces HTTP direct aux fichiers de cache (contenu non
+# sensible, mais autant ne pas l'exposer inutilement).
+Require all denied
diff --git a/php/common.php b/php/common.php
index b08f543..273eaf4 100644
--- a/php/common.php
+++ b/php/common.php
@@ -30,6 +30,7 @@ function http_get(string $url, array $extraHeaders = []): string
         CURLOPT_HTTPHEADER => array_merge(['Accept: application/json'], $extraHeaders),
         CURLOPT_TIMEOUT => 20,
         CURLOPT_FOLLOWLOCATION => true,
+        CURLOPT_MAXREDIRS => 3,
     ]);
     $body = curl_exec($ch);
     $errno = curl_errno($ch);