AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(proxy): Prevent external access to outgoing proxy in host-network mode

Browse Source
This commit is contained in:
Maksim Eltyshev
2026-03-01 15:57:12 +01:00
parent d5d3f1de44
commit 66ff3b65c6
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/start.sh
+7 -3
View File
@@ -41,7 +41,7 @@ start_outgoing_proxy_if_needed() {
# Basic settings
echo "pid_filename $SQUID_PID" >> "$SQUID_CONF"
echo "http_port 3128" >> "$SQUID_CONF"
echo "http_port 127.0.0.1:3128" >> "$SQUID_CONF"
echo "acl all src all" >> "$SQUID_CONF"
# Disable caching
@@ -52,11 +52,11 @@ start_outgoing_proxy_if_needed() {
echo "cache_swap_high 0" >> "$SQUID_CONF"
# Disable logs
echo "access_log /tmp/test.log" >> "$SQUID_CONF"
echo "access_log none" >> "$SQUID_CONF"
echo "cache_store_log none" >> "$SQUID_CONF"
echo "cache_log /dev/null" >> "$SQUID_CONF"
echo "logfile_rotate 0" >> "$SQUID_CONF"
echo "debug_options ALL,1" >> "$SQUID_CONF"
echo "debug_options ALL,0" >> "$SQUID_CONF"
# Make it pass-through like
echo "forwarded_for delete" >> "$SQUID_CONF"
@@ -65,6 +65,10 @@ start_outgoing_proxy_if_needed() {
echo "request_header_access Via deny all" >> "$SQUID_CONF"
echo "request_header_access Cache-Control deny all" >> "$SQUID_CONF"
# Allow only local sources
echo "acl localhost_src src 127.0.0.1" >> "$SQUID_CONF"
echo "http_access deny !localhost_src" >> "$SQUID_CONF"
# Blocked IPs
if [[ -n "${OUTGOING_BLOCKED_IPS:-}" ]]; then
IFS=',' read -ra BLOCKED_IPS <<< "$OUTGOING_BLOCKED_IPS"