[M-16] connectToken/promote lack DNS-rebinding protection

Deferred — see reply.

Deferred.

The fix as stated requires resolving the hostname once in PHP, then passing the IP (not the host) to stream_socket_client inside BbsTelnetCapture::capture. In practice, the SSH/telnet protocols on the other side often care about the hostname (for routing, SNI, rDNS), so passing a bare IP can break legitimate BBSes that rely on virtual hosting, load balancers, or hostname-based routing.

The proper fix is to:

1. Resolve once and store both host and resolved IP.
2. Call the upstream with the host header / SNI intact but connect to the pinned IP — similar to what curl --resolve does.

That requires a custom resolver hook and protocol-specific handling that's out of scope for a pure-PHP drop-in.

In the meantime, this is admin-only (role ≥ 4), the isPublicHost check still catches static private/link-local addresses, and an attacker would need both a compromised admin account and a DNS rebinding server under their control. Re-opening would require the infrastructure work above.

Leaving this thread unlocked — not considered closed.