SSRF issue : Protection triggered

[JFMALBI]

To be completed by the original poster:

CMS Version

4.5.2

Installation Method

Docker install

Operating System

Ubuntu 24.04

Issue

We have updagred our onpremise Xibo, deployed with Docker, and we have an error with our Dadaset. : run: SSRF Protection triggered. Blocked request to restricted IP: 10.x.x.x Exception Type: RuntimeException

We found on the Xibo github that Xibo have improved security features and it seems that we have to set allow_local_network config flag to true … but we are with a docker image. How can we proceed ?

[MrStefan]

There’s a note under the changelogs if your CMS instance runs behind a reverse proxy or load balancer. Perhaps this could be relevant.

CMS v4.5.2 - Changelog | Xibo Docs

[dan]

@JFMALBI

We found on the Xibo github that Xibo have improved security features and it seems that we have to set allow_local_network config flag to true … but we are with a docker image. How can we proceed ?

You can set the following:

// custom/settings-custom.php
$allowLocalNetworkRequests = true;

For anyone interested, these security changes are explained here: GitHub - xibosignage/xibo-cms: Xibo Content Management System · GitHub

@MrStefan

There’s a note under the changelogs if your CMS instance runs behind a reverse proxy or load balancer.

Yes, this is another security measure, although a different one from the OP. If you have a reverse proxy in front of your CMS, you need to tell Xibo its IP so that it trusts it.