Security patch

lib/Service/DirectoryService.php

@@ -297,7 +297,6 @@ public function updateListing(array $newListing, array $oldListing): array{
 
 		return $newListing->jsonSerialize();
 	}
-
 	/**
 	 * Synchronize with an external directory
 	 *
@@ -309,6 +308,15 @@ public function updateListing(array $newListing, array $oldListing): array{
 	 */
 	public function syncExternalDirectory(string $url): array
 	{
+		// Check if URL contains 'local' and throw exception if it does
+		if (str_contains(strtolower($url), 'local')) {
+			throw new \Exception('Local URLs are not allowed');
+		}
+		// Validate the URL
+		if (!filter_var($url, FILTER_VALIDATE_URL)) {
+			throw new \InvalidArgumentException('Invalid URL provided');
+		}
+
 		// Get the directory data
 		$result = $this->client->get($url);
 
@@ -428,6 +436,10 @@ public function synchronise(?string $id = null): array
 	 */
 	public function syncPublicationType(string $url): array
 	{
+		// Check if URL contains 'local' and throw exception if it does
+		if (str_contains(strtolower($url), 'local')) {
+			throw new \Exception('Local URLs are not allowed');
+		}
 		// Validate the URL
 		if (!filter_var($url, FILTER_VALIDATE_URL)) {
 			throw new \InvalidArgumentException('Invalid URL provided');