Block preloading of Path or Injection-Info headers.

2024-02-17 22:30:48 -07:00 · 2024-02-17 22:30:48 -07:00 · 4c58cb8b95
parent 2c6c08c044
commit 4c58cb8b95
1 changed files with 8 additions and 0 deletions
--- a/Rocksolid_Light/rslight/scripts/rslight-lib.php
+++ b/Rocksolid_Light/rslight/scripts/rslight-lib.php
@ -355,6 +355,14 @@ function process_post($message, $group)
                $ref = 0;
                $sub = 0;
            }
+            if (stripos($line, "Path: ") === 0) {
+                $response = "441 Posting failed (Header preloading denied)\r\n";
+                return $response;
+            }
+            if (stripos($line, "Injection-Info: ") === 0) {
+                $response = "441 Posting failed (Header preloading denied)\r\n";
+                return $response;
+            }
            if (stripos($line, "Date: ") === 0) {
                $finddate = explode(': ', $line);
                $article_date = strtotime($finddate[1]);