mirror/snipe-it
3
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2026-08-18 03:06:23 +00:00
Code Issues Projects Releases Wiki Activity

Added loopback flag

Browse Source
This commit is contained in:
snipe
2026-07-27 00:02:18 +01:00
parent 4d6563343a
commit bfab29d9a9
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
config/app.php
View File

@ -357,6 +357,31 @@ return [
'lock_passwords' => env('APP_LOCKED', false),
/*
|--------------------------------------------------------------------------
| Allow test buttons to target private / loopback IPs
|--------------------------------------------------------------------------
|
| Various admin screens (LDAP wizard, Google OAuth, webhook config, etc.)
| expose "Test" buttons that fire a real network request to a user-
| supplied host. Without a guard these are SSRF / port-scanning vectors:
| a superadmin (compromised account, insider, or SaaS tenant) could
| probe internal-only services, cloud metadata endpoints (169.254.169.254),
| loopback, etc. and read the distinguishing error responses to
| enumerate them.
|
| Default: false. The test helpers resolve the hostname and reject any
| URL that lands on a private / loopback / link-local / reserved range.
|
| Set to true ONLY when the Snipe-IT installation is legitimately
| pointed at services on the same private network (self-hosted on-prem
| alongside internal AD/Slack/webhooks is the typical case). Never
| enable on hosted / multi-tenant deployments.
|
*/
'test_allow_private_ips' => env('TEST_ALLOW_PRIVATE_IPS', false),
/*
|--------------------------------------------------------------------------
| Superuser Impersonation