Changeset 3389291

Timestamp:

11/04/2025 02:40:28 AM (6 weeks ago)

Author:

Alignak

Message:

v3.5.4

Location:

fast-velocity-minify/trunk

Files:

• fvm.php (modified) (1 diff)
• inc/common.php (modified) (2 diffs)
• readme.txt (modified) (2 diffs)

fast-velocity-minify/trunk/fvm.php

@@ -4 +4 @@
  * Plugin URI: https://fastvelocity.com
  * Description: Improve your speed score on GTmetrix, Pingdom Tools and Google PageSpeed Insights by merging and minifying CSS and JavaScript files into groups, compressing HTML and other speed optimizations.
- * Version: 3.5.3
+ * Version: 3.5.4
  * Author: Raul Peixoto
  * Author URI: https://fastvelocity.com

fast-velocity-minify/trunk/inc/common.php

@@ -2405 +2405 @@
     }
 
-    # Block internal/private IP ranges to prevent SSRF
-    $ip = gethostbyname($parsed['host']);
-    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
-        return array('error' => 'Access to private/internal IPs is not allowed');
-    }
-
-    # get domain
+    # get domain early to determine if this is a local or external resource
     global $fvm_urls;
-    
-    # check if we can open the file locally first
-    if (stripos($url, $fvm_urls['wp_domain']) !== false && defined('ABSPATH') && !empty('ABSPATH')) {
+    $is_local_domain = false;
+    if (isset($fvm_urls['wp_domain']) && !empty($fvm_urls['wp_domain'])) {
+        $is_local_domain = (stripos($url, $fvm_urls['wp_domain']) !== false);
+    }
+
+    # For local WordPress domain URLs, try to read from disk first (no SSRF risk)
+    if ($is_local_domain && defined('ABSPATH') && !empty('ABSPATH')) {
         
         # file path + windows compatibility
@@ -2444 +2442 @@
 
     # fallback to downloading
-    
+
     # this useragent is needed for google fonts (woff files only + hinted fonts)
     $uagent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586';

fast-velocity-minify/trunk/readme.txt

@@ -4 +4 @@
 Requires at least: 5.6
 Requires PHP: 7.2
-Stable tag: 3.5.3
+Stable tag: 3.5.4
 Tested up to: 6.8.3
 Text Domain: fast-velocity-minify
@@ -49 +49 @@
 
 == Changelog ==
+
+= 3.5.4 [2025.11.04] =
+* Removed the unecessary SSRF checks for external requests that were blocking sites behind NAT or intranet deployments
 
 = 3.5.3 [2025.10.23] =