Merge pull request #466 from whikloj/patch-2

Check for hostname
Islandora · Sep 10, 2014 · e970865 · e970865
2 parents 8e67a49 + ab437cc
commit e970865
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/islandora.module b/islandora.module
@@ -1564,9 +1564,12 @@ function islandora_entity_property_info() {
  */
 function islandora_download_clip(AbstractObject $object) {
   if (isset($_GET['clip'])) {
-    $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
-    $http_protocol = $is_https ? 'https' : 'http';
-    $url = $http_protocol . '://' . $_SERVER['HTTP_HOST'] . $_GET['clip'];
+    $url = $_GET['clip'];
+    if (!preg_match('/^https?:\/\//', $url)) {
+      $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
+      $http_protocol = $is_https ? 'https' : 'http';
+      $url = $http_protocol . '://' . $_SERVER['HTTP_HOST'] . $url;
+    }
     $filename = $object->label;
     header("Content-Disposition: attachment; filename=\"{$filename}.jpg\"");
     header("Content-type: image/jpeg");