mirror_php/formwork
1
0
Fork 0
mirror of https://github.com/getformwork/formwork.git synced 2025-02-24 01:32:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Validate referer before redirecting

Browse Source
This commit is contained in:
Giuseppe Criscione 2019-03-16 14:01:02 +01:00
parent 9b405395d9
commit 05bb5b1c41
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
admin/src/AdminTrait.php
View File

@ -84,7 +84,7 @@ trait AdminTrait
*/
protected function redirectToReferer($code = 302, $default = '/')
{
if (!is_null(HTTPRequest::referer()) && HTTPRequest::referer() !== Uri::current()) {
if (HTTPRequest::validateReferer($this->uri('/')) && HTTPRequest::referer() !== Uri::current()) {
Header::redirect(HTTPRequest::referer(), $code);
} else {
Header::redirect($this->uri($default), $code);

13
formwork/Utils/HTTPRequest.php
View File

@ -108,6 +108,19 @@ class HTTPRequest
return static::hasHeader('Referer') ? static::$headers['Referer'] : null;
}
/**
* Check if the request referer has the same origin
*
* @param string $path Optional URI path
*
* @return bool
*/
public static function validateReferer($path = null)
{
$base = Uri::normalize(Uri::base() . '/' . ltrim($path, '/'));
return substr(static::referer(), 0, strlen($base)) === $base;
}
/**
* Get request origin
*