Limit CURL to only HTTP & HTTPS

Bug 1394820

Change-Id: I710098cb96ac7d0868926a95c4b4488df4753e4c

htdocs/lib/web.php

@@ -3948,6 +3948,7 @@ function mahara_http_request($config, $quiet=false) {
     $ch = curl_init();
 
     // standard curl_setopt stuff; configs passed to the function can override these
+    curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
     curl_setopt($ch, CURLOPT_TIMEOUT, 60);
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
     if (!ini_get('open_basedir')) {
@@ -4012,6 +4013,7 @@ function mahara_shorturl_request($url, $quiet=false) {
     $ch = curl_init($url);
 
     // standard curl_setopt stuff; configs passed to the function can override these
+    curl_setopt($ch, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
     curl_setopt($ch, CURLOPT_TIMEOUT, 60);
     curl_setopt($ch, CURLOPT_HEADER, true);
     curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);