From 5a6dc4940ce8213645085863be3c212b5a25a7ae Mon Sep 17 00:00:00 2001
From: root <root@web.ch1860.ced-network.net>
Date: Sun, 5 Apr 2020 20:46:45 +0200
Subject: [PATCH] stricter destination filter

---
 xExtension-ImageProxy/README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/xExtension-ImageProxy/README.md b/xExtension-ImageProxy/README.md
index f57cf2d..23f5cad 100644
--- a/xExtension-ImageProxy/README.md
+++ b/xExtension-ImageProxy/README.md
@@ -59,7 +59,11 @@ RewriteRule ^ http://%1 [QSA,P,L]
   Satisfy any
 </Location>
 # CRITICAL: Do NOT allow access to local resources!!!
-<LocationMatch "^/proxy/.*(localhost|127\.0\.0\.1|::1|local\.domain)">
+#  - (any) IPv4
+#  - (any) IPv6
+#  - localhost
+#  - local.domain (e.g. example.org)
+<LocationMatch "^/proxy/https?:/+([0-9]{1,3}(\.[0-9]{1,3}){3}|([0-9a-zA-Z]{0,4}:?)?(:[0-9a-zA-Z]{1,4}:){0,6}([.:][0-9a-zA-Z]{1,4}){1,7}|[^/]*(localhost|local\.domain|example\.org))(/|$)">
   Require all denied
 </LocationMatch>
 ```