mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-02 14:57:37 +02:00
Code Issues Releases Wiki Activity

Merge branch 'ticket/security-180' into ticket/security-180-asc

Browse Source 
Conflicts:
	tests/security/redirect_test.php
This commit is contained in:
Marc Alexander
2015-04-11 16:47:50 +02:00
committed by Andreas Fischer
parent 969718fc91 bca1b96b2e
commit 89723b17d9
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
phpBB/includes/functions.php
View File

@@ -2352,6 +2352,12 @@ function redirect($url, $return = false, $disable_cd_check = false)
trigger_error('INSECURE_REDIRECT', E_USER_ERROR); trigger_error('INSECURE_REDIRECT', E_USER_ERROR);
} }
// Make sure we don't redirect to external URLs
if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0)
{
trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
}
// Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2 // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false) if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
{ {

3
tests/security/redirect_test.php
View File

@@ -51,6 +51,9 @@ class phpbb_security_redirect_test extends phpbb_security_test_base
array('../index.php', false, false, 'http://localhost/index.php'), array('../index.php', false, false, 'http://localhost/index.php'),
array('../index.php', true, false, 'http://localhost/index.php'), array('../index.php', true, false, 'http://localhost/index.php'),
array('./index.php', false, false, 'http://localhost/phpBB/index.php'), array('./index.php', false, false, 'http://localhost/phpBB/index.php'),
array('https://foobar.com\@http://localhost/phpBB', false, false, 'http://localhost/phpBB'),
array('https://foobar.com\@localhost/troll/http://localhost/', false, 'INSECURE_REDIRECT', false),
array('http://localhost.foobar.com\@localhost/troll/http://localhost/', false, 'INSECURE_REDIRECT', false),
); );
} }