From 21c1686f5e8d9fff8b69637210ae7c57dda12c68 Mon Sep 17 00:00:00 2001
From: Anton Parsons <anton.parsons@adition.com>
Date: Wed, 3 Jun 2015 11:01:57 +0200
Subject: [PATCH] Added valid http protocol validation check.

---
 imageDownload.php | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/imageDownload.php b/imageDownload.php
index c5250fd..724b772 100755
--- a/imageDownload.php
+++ b/imageDownload.php
@@ -1,16 +1,19 @@
 <?php 
 $file = $_REQUEST['imageUrl'];
-if(!$file){
-  // File doesn't exist, output error
-  die('file not found');
-}else{
-  // Set headers
-  header("Cache-Control: public");
-  header("Content-Description: File Transfer");
-  header("Content-Disposition: attachment; filename=$file");
-  header("Content-Type: image/gif");
-  header("Content-Transfer-Encoding: binary");
-  // Read the file from disk
-  readfile($file);
+
+//Check the scheme ://, http:// or https:// followed by a valid hostname name start
+$validHTTPURLBegin = '/^(:|http(s?):)\/\/[\w]+/';
+if (!preg_match($validHTTPURLBegin, $file)) {
+    die('File is not a valid URL');
 }
+
+// Set headers
+header("Cache-Control: public");
+header("Content-Description: File Transfer");
+header("Content-Disposition: attachment; filename=$file");
+header("Content-Type: image/gif");
+header("Content-Transfer-Encoding: binary");
+// Read the file from disk
+readfile($file);
+
 ?>
\ No newline at end of file