lucaspalomodevelop/core
1
0
Fork 0
mirror of https://github.com/lucaspalomodevelop/core.git synced 2026-03-13 08:09:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

login - use parse_url to validate if the provided redirect string is actually parseable to prevent redirect. looks like https://github.com/opnsense/core/issues/4061 was incomplete

Browse Source 
(bugfix 3c2f32ec8d)
This commit is contained in:
Ad Schellevis 2023-07-04 20:52:13 +02:00
parent e60e4cd9c2
commit 6bc025af17
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/etc/inc/authgui.inc
View File

@ -188,7 +188,12 @@ function session_auth()
if (!empty($_GET['url'])) {
$tmp_url_parts = parse_url($_GET['url']);
if ($tmp_url_parts !== false) {
$redir_uri = $tmp_url_parts['path'];
$redir_uri = sprintf(
'%s://%s/%s',
isset($_SERVER['HTTPS']) ? 'https' : 'http',
$_SERVER['HTTP_HOST'],
ltrim($tmp_url_parts['path'], '/')
);
$redir_uri .= !empty($tmp_url_parts['query']) ? "?" . $tmp_url_parts['query'] : "";
$redir_uri .= !empty($tmp_url_parts['fragment']) ? "#" . $tmp_url_parts['fragment'] : "";
header(url_safe("Location: {$redir_uri}"));