Fix SSRF bypass of trusted_uri via redirect-following in {fetch}

When a security policy is active and {fetch} is used with a non-http URL
scheme (https, ftp, ...), file_get_contents was called without a stream
context. PHP's HTTP wrapper follows redirects by default, so an Open
Redirect on a trusted host could be used to bypass the trusted_uri check
and reach arbitrary internal addresses (SSRF).

Pass a stream context with follow_location=0 and max_redirects=1 when a
security policy is configured. Behaviour is unchanged for users without
a security policy.

Reported by Aleksey Solovev (Positive Technologies), PT-03-2026.

changelog/ssrf-pt-03-2026.md

@@ -0,0 +1 @@
+- Security: prevent SSRF bypass of `trusted_uri` via redirect-following in `{fetch}`. When a security policy is active, the HTTP stream wrapper no longer auto-follows redirects, so an Open Redirect on a trusted host can no longer be used to reach arbitrary URIs. Reported by Aleksey Solovev (Positive Technologies), PT-03-2026.

src/FunctionHandler/Fetch.php

@@ -189,7 +189,19 @@ class Fetch extends Base {
 				return;
 			}
 		} else {
-			$content = @file_get_contents($params['file']);
+			$context = null;
+			if (isset($template->getSmarty()->security_policy)) {
+				// When a security policy is active, the trusted_uri check only validates
+				// the URL passed to {fetch}. PHP's HTTP stream wrapper follows redirects
+				// by default, which would let an Open Redirect on a trusted host bypass
+				// the policy and reach arbitrary internal addresses (SSRF). Disable
+				// redirect following for the policy-checked request. See PT-03-2026.
+				$context = stream_context_create([
+					'http'  => ['follow_location' => 0, 'max_redirects' => 1],
+					'https' => ['follow_location' => 0, 'max_redirects' => 1],
+				]);
+			}
+			$content = @file_get_contents($params['file'], false, $context);
 			if ($content === false) {
 				throw new Exception("{fetch} cannot read resource '" . $params['file'] . "'");
 			}