Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-04-29 18:59:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't allow redirect to external website

Browse Source
This commit is contained in:
slawkens 2024-04-08 19:08:21 +02:00
parent 1186f94e21
commit c92a410209
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
system/logout.php
View File

@ -22,11 +22,5 @@ if(isset($account_logged) && $account_logged->isLoaded()) {
$logged = false; $logged = false;
unset($account_logged); unset($account_logged);
if(isset($_REQUEST['redirect']))
{
header('Location: ' . urldecode($_REQUEST['redirect']));
exit;
}
} }
} }

6
system/pages/account/redirect.php
View File

@ -12,6 +12,12 @@ defined('MYAAC') or die('Direct access not allowed!');
$redirect = urldecode($_REQUEST['redirect']); $redirect = urldecode($_REQUEST['redirect']);
// should never happen, unless hacker modify the URL
if (!str_contains($_REQUEST['redirect'], BASE_URL)) {
error('Fatal error: Cannot redirect outside the website.');
return;
}
$twig->display('account.redirect.html.twig', array( $twig->display('account.redirect.html.twig', array(
'redirect' => $redirect 'redirect' => $redirect
)); ));