Merge branch 'security/4.0.3-releng' into 4.0.3-releng

Author: sunnavy

lib/RT/IR.pm

@@ -635,6 +635,14 @@ sub FirstWhoisServer {
     return $res;
 }
 
+sub IsValidWhoisServer {
+    my $self = shift;
+    my $server = lc (shift or return 0);
+    my $servers = RT->Config->Get('whois');
+
+    return ((grep { lc $_ eq $server } map { ref $_ ? $_->{'Host'} : $_ } values %$servers) ? 1 : 0);
+}
+
 sub WhoisLookup {
     my $self = shift;
     my %args = (
@@ -647,6 +655,9 @@ sub WhoisLookup {
     return (undef, $args{'CurrentUser'}->loc("No whois servers configured"))
         unless $server;
 
+    return (undef, $args{'CurrentUser'}->loc("Invalid whois server specified"))
+        unless $self->IsValidWhoisServer( $server );
+
     my ($host, $port) = split /\s*:\s*/, $server, 2;
     $port = 43 unless ($port || '') =~ /^\d+$/;