[SS-2016-001] FIX Properly check backurl on CMSSecurity@success

silverstripe · Apr 20, 2016 · 1ccd392 · 1ccd392
1 parent 1f820b0
commit 1ccd392
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/security/CMSSecurity.php b/security/CMSSecurity.php
@@ -186,9 +186,16 @@ public function success() {
 
 		// Get redirect url
 		$controller = $this->getResponseController(_t('CMSSecurity.SUCCESS', 'Success'));
-		$backURL = $this->request->requestVar('BackURL')
-			?: Session::get('BackURL')
-			?: Director::absoluteURL(AdminRootController::config()->url_base, true);
+		$backURLs = array(
+			$this->getRequest()->requestVar('BackURL'),
+			Session::get('BackURL'),
+			Director::absoluteURL(AdminRootController::config()->url_base, true),
+		);
+		foreach ($backURLs as $backURL) {
+			if ($backURL && Director::is_site_url($backURL)) {
+				break;
+			}
+		}
 
 		// Show login
 		$controller = $controller->customise(array(