Language: PHP
Label: vulnerable
CWE: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Code:
	private function initSession(){
		$this->apiSignCheck();
		// 入口不处理cookie,兼容服务器启用了全GET缓存情况(输出前一次用户登录的cookie,导致账号登录异常)
		$action= strtolower(ACTION);
		if( $action == 'user.index.index' || 
		    $action == 'user.view.call'){
			Cookie::disable(true);
		}
		
		$systemPassword = Model('SystemOption')->get('systemPassword');
		$accessToken = isset($_REQUEST['accessToken']) ? $_REQUEST['accessToken'] : '';
		if($accessToken && strlen($accessToken) < 500){
			$pass = substr(md5('kodbox_'.$systemPassword),0,15);
			$sessionSign = Mcrypt::decode($accessToken,$pass);
			if(!$sessionSign){show_json(LNG('common.loginTokenError'),ERROR_CODE_LOGOUT);}
			$this->initAccessToken();
			Session::sign($sessionSign);
		}
		
		if(!Session::get('kod')){
			Session::set('kod',1);
			if(!Session::get('kod')){show_tips(LNG('explorer.sessionSaveError'));}
		}
		// 注意: Session设置sessionid的cookie;两个请求时间过于相近,可能导致删除cookie失败的问题;(又有sessionid请求覆盖)
		// 设置csrf防护;
		if(!Cookie::get('CSRF_TOKEN')){Cookie::set('CSRF_TOKEN',rand_string(16));}
	}