SSRF Protection triggered

Get Help Xibo Player for Linux
1

Player Version

Version: 4.4.3

Issue

When trying to add a media URL in Library/Media to an internal website, I get “Unexpected Error, please contact support.”

I changed the log to Error level and get: SSRF Protection triggered. Blocked request to restricted IP: IP_ADDRESS.

Xibo is installed with Docker on a Ubuntu Server with Apache, I can ping the hosting server for the internal website and the actual website after I added the local DNS both in the Docker and in Ubuntu.

What I have done so far:

  • Added the DNS server to both Ubuntu and Docker which resolved the local.name
  • Tried using IP address instead of the local.name in Xibo
  • Changed in SafeClient.php: $stack->unshift(SsrfProtectionMiddleware::create([
    ‘allow_local_network’ => $config[‘xibo’][‘allow_local_network’] ?? true
    ]), ‘ssrf_protection’); I copied it from the container, edited the file and added it to mount in the compose file and finally restarted. I have verified that the new file is mounted with the new changes.

I have tried to search for a solution and related to the SSRF but with no luck.

Thanks in advance for any help or guidance!

2

I’m trying also different widgets when creating a Layout but that does not work. Important note here is that the internal webpages are PHP.

3

I have resolved the issue. I need to use webpage widget but why some were not working was a CSS issue.