Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-05-13 09:29:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't allow redirect to external website

Browse Source
This commit is contained in:
slawkens 2024-04-08 19:08:21 +02:00
parent 1186f94e21
commit c92a410209
2 changed files with 6 additions and 6 deletions
system
logout.php
pages/account
redirect.php

6
system/logout.php

@ -22,11 +22,5 @@ if(isset($account_logged) && $account_logged->isLoaded()) {
$logged = false;
unset($account_logged);
if(isset($_REQUEST['redirect']))
{
header('Location: ' . urldecode($_REQUEST['redirect']));
exit;
}
}
}

6
system/pages/account/redirect.php

@ -12,6 +12,12 @@ defined('MYAAC') or die('Direct access not allowed!');
$redirect = urldecode($_REQUEST['redirect']);
// should never happen, unless hacker modify the URL
if (!str_contains($_REQUEST['redirect'], BASE_URL)) {
error('Fatal error: Cannot redirect outside the website.');
return;
}
$twig->display('account.redirect.html.twig', array(
'redirect' => $redirect
));