mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-31 14:00:31 +02:00
Code Issues Releases Wiki Activity

Merge branch 'ticket/security-180' into ticket/security-180-asc

Browse Source 
Conflicts:
	tests/security/redirect_test.php
This commit is contained in:
Marc Alexander
2015-04-11 16:47:50 +02:00
committed by Andreas Fischer
parent 969718fc91 bca1b96b2e
commit 89723b17d9
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
phpBB/includes/functions.php
View File

@@ -2352,6 +2352,12 @@ function redirect($url, $return = false, $disable_cd_check = false)
trigger_error('INSECURE_REDIRECT', E_USER_ERROR);
}
// Make sure we don't redirect to external URLs
if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0)
{
trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
}
// Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
{