From eb0c2a76741329cf7260ca077e5260d0828d6105 Mon Sep 17 00:00:00 2001 From: slawkens Date: Sun, 14 Apr 2024 16:02:55 +0200 Subject: [PATCH] Post-fix redirect --- system/pages/account/manage.php | 6 ++++++ system/pages/account/redirect.php | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/system/pages/account/manage.php b/system/pages/account/manage.php index 615ffdc71f..d0a3eb75cf 100644 --- a/system/pages/account/manage.php +++ b/system/pages/account/manage.php @@ -21,6 +21,12 @@ if(isset($_REQUEST['redirect'])) { $redirect = urldecode($_REQUEST['redirect']); + + // should never happen, unless hacker modify the URL + if (!str_contains($redirect, BASE_URL)) { + error('Fatal error: Cannot redirect outside the website.'); + return; + } $twig->display('account.redirect.html.twig', array( 'redirect' => $redirect diff --git a/system/pages/account/redirect.php b/system/pages/account/redirect.php index 1665916092..78bc54d95e 100644 --- a/system/pages/account/redirect.php +++ b/system/pages/account/redirect.php @@ -13,7 +13,7 @@ $redirect = urldecode($_REQUEST['redirect']); // should never happen, unless hacker modify the URL -if (!str_contains($_REQUEST['redirect'], BASE_URL)) { +if (!str_contains($redirect, BASE_URL)) { error('Fatal error: Cannot redirect outside the website.'); return; }