Fix even more redirects.

There are a bunch of ways to redirect in Horde.
horde · Jul 3, 2017 · ea59bad · ea59bad
1 parent 1e58062
commit ea59bad
Show file tree

Hide file tree

Showing 8 changed files with 24 additions and 11 deletions.
diff --git a/nag/app/controllers/CompleteTask.php b/nag/app/controllers/CompleteTask.php
@@ -18,8 +18,8 @@ public function processRequest(Horde_Controller_Request $request, Horde_Controll
             $requestVars['format'] == 'json') {
             $response->setContentType('application/json');
             $response->setBody(json_encode($result));
-        } elseif ($requestVars['url']) {
-            $response->setRedirectUrl($requestVars['url']);
+        } elseif ($url = Horde::verifySignedUrl($requestVars['url'])) {
+            $response->setRedirectUrl($url);
         }
     }
 }
diff --git a/nag/app/controllers/SaveTask.php b/nag/app/controllers/SaveTask.php
@@ -110,11 +110,14 @@ public function processRequest(Horde_Controller_Request $request, Horde_Controll
                 'tasklist_id' => $info['tasklist_id'],
                 'parent' => $info['parent']));
         } else {
-            $url = Horde_Util::getFormData('url', (string)Horde::url('list.php', true));
-            $url = Horde::url($url, true);
+            if ($url = Horde::verifySignedUrl(Horde_Util::getFormData('url'))) {
+                $url = Horde::url($url, true);
+            } else {
+                $url = Horde::url('list.php', true);
+            }
         }
 
-        $response->setRedirectUrl($url);
+        $response->setRedirectUrl((string)$url);
     }
 
     /**

diff --git a/nag/docs/CHANGES b/nag/docs/CHANGES
@@ -2,6 +2,7 @@
 v4.2.15-git
 -----------
 
+[jan] SECURITY: Fix open redirects.
 [mjr] Fix handling of delayed start dates (Bug #14634).
 
 

diff --git a/nag/package.xml b/nag/package.xml
@@ -33,6 +33,7 @@
  </stability>
  <license uri="http://www.horde.org/licenses/gpl">GPL-2.0</license>
  <notes>
+* [jan] SECURITY: Fix open redirects.
 * [mjr] Fix handling of delayed start dates (Bug #14634).
  </notes>
  <contents>
@@ -575,7 +576,7 @@
    <package>
     <name>Horde_Core</name>
     <channel>pear.horde.org</channel>
-    <min>2.6.1</min>
+    <min>2.30.0</min>
     <max>3.0.0alpha1</max>
     <exclude>3.0.0alpha1</exclude>
    </package>
@@ -1793,6 +1794,7 @@
    <date>2017-03-20</date>
    <license uri="http://www.horde.org/licenses/gpl">GPL-2.0</license>
    <notes>
+* [jan] SECURITY: Fix open redirects.
 * [mjr] Fix handling of delayed start dates (Bug #14634).
    </notes>
   </release>

diff --git a/trean/app/controllers/DeleteBookmark.php b/trean/app/controllers/DeleteBookmark.php
@@ -21,7 +21,10 @@ public function processRequest(Horde_Controller_Request $request, Horde_Controll
             $response->setContentType('application/json');
             $response->setBody(json_encode($result));
         } else {
-            $response->setRedirectUrl(Horde_Util::getFormData('url', Horde::url('browse.php', true)));
+            if (!($url = Horde::verifySignedUrl(Horde_Util::getFormData('url')))) {
+                $url = Horde::url('browse.php', true);
+            }
+            $response->setRedirectUrl($url);
         }
     }
 }
diff --git a/trean/app/controllers/SaveBookmark.php b/trean/app/controllers/SaveBookmark.php
@@ -30,7 +30,10 @@ public function processRequest(Horde_Controller_Request $request, Horde_Controll
             $response->setContentType('application/json');
             $response->setBody(json_encode($result));
         } else {
-            $response->setRedirectUrl(Horde_Util::getFormData('url', Horde::url('browse.php', true)));
+            if (!($url = Horde::verifySignedUrl(Horde_Util::getFormData('url')))) {
+                $url = Horde::url('browse.php', true);
+            }
+            $response->setRedirectUrl($url);
         }
     }
 }
diff --git a/trean/docs/CHANGES b/trean/docs/CHANGES
@@ -2,6 +2,7 @@
 v1.1.8-git
 ----------
 
+[jan] SECURITY: Fix open redirects.
 
 
 ------

diff --git a/trean/package.xml b/trean/package.xml
@@ -33,7 +33,7 @@
  </stability>
  <license uri="http://www.horde.org/licenses/bsd">BSD-2-Clause</license>
  <notes>
-* 
+* [jan] SECURITY: Fix open redirects.
  </notes>
  <contents>
   <dir baseinstalldir="/" name="/">
@@ -326,7 +326,7 @@
    <package>
     <name>Horde_Core</name>
     <channel>pear.horde.org</channel>
-    <min>2.0.0</min>
+    <min>2.30.0</min>
     <max>3.0.0alpha1</max>
     <exclude>3.0.0alpha1</exclude>
    </package>
@@ -813,7 +813,7 @@
    <date>2016-12-16</date>
    <license uri="http://www.horde.org/licenses/bsd">BSD-2-Clause</license>
    <notes>
-* 
+* [jan] SECURITY: Fix open redirects.
    </notes>
   </release>
  </changelog>