Skip to content

Commit

Permalink
use strtolower to make sure it's case insensitive
Browse files Browse the repository at this point in the history
  • Loading branch information
@zeruniverse
zeruniverse committed Sep 22, 2016
1 parent c5159d2 commit dfff00a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/function/sqllink.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ function checksession($link)
global $SERVER_TIMEOUT, $HOSTDOMAIN;
session_start();
if(!isset($_SESSION['loginok'])||$_SESSION['loginok']!=1) {session_destroy();return FALSE;}
if(isset($_SERVER['HTTP_REFERER'])&&($_SERVER['HTTP_REFERER']!='')&&(strpos($_SERVER['HTTP_REFERER'], $HOSTDOMAIN)!==0))
if(isset($_SERVER['HTTP_REFERER'])&&($_SERVER['HTTP_REFERER']!='')&&(strpos(strtolower($_SERVER['HTTP_REFERER']), strtolower($HOSTDOMAIN))!==0))

This comment has been minimized.

Sign in to view

Copy link
@BenjaminHae

BenjaminHae Sep 22, 2016

Collaborator

For example, if your site is "site.com" make sure "site.com.attacker.com" doesn't pass your origin check.(https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Checking_The_Referer_Header)

This comment has been minimized.

Sign in to view

Copy link
@zeruniverse

zeruniverse Sep 22, 2016

Author Owner

Didn't I check "http://example.com/"? Can you have a domain "example.com/.attacker.com"?

This comment has been minimized.

Sign in to view

Copy link
@BenjaminHae

BenjaminHae Sep 22, 2016

Collaborator

yes, but the other way around. attacker.com/example.com as a folder does work. I'd fear http:// is not a problem.

This comment has been minimized.

Sign in to view

Copy link
@zeruniverse

zeruniverse Sep 22, 2016

Author Owner

No, 'http://example.com/' must be at the beginning of the referrer to pass the check

This comment has been minimized.

Sign in to view

Copy link
@BenjaminHae

BenjaminHae Sep 22, 2016

Collaborator

Alright. Sorry. New rule:i don't try to contribute on workdays.

This comment has been minimized.

Sign in to view

Copy link
@zeruniverse

zeruniverse Sep 22, 2016

Author Owner

Oh, you're right. I forget the '/'. In config.php I just wrote http://example.com

This comment has been minimized.

Sign in to view

Copy link
@zeruniverse

zeruniverse Sep 22, 2016

Author Owner

I'll mention it in wiki
{
//Users from other sites are banned
session_destroy();
Expand Down

0 comments on commit dfff00a

Please sign in to comment.