makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'ticket/security-180' into ticket/security-180-asc

Browse source 
Conflicts:
	tests/security/redirect_test.php
This commit is contained in:
Marc Alexander 2015-04-11 16:47:50 +02:00 • committed by Andreas Fischer
commit 89723b17d9
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
phpBB/includes/functions.php
View file

@ -2352,6 +2352,12 @@ function redirect($url, $return = false, $disable_cd_check = false)
trigger_error('INSECURE_REDIRECT', E_USER_ERROR); trigger_error('INSECURE_REDIRECT', E_USER_ERROR);
} }
// Make sure we don't redirect to external URLs
if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0)
{
trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
}
// Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2 // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false) if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
{ {

3
tests/security/redirect_test.php
View file

@ -51,6 +51,9 @@ class phpbb_security_redirect_test extends phpbb_security_test_base
array('../index.php', false, false, 'http://localhost/index.php'), array('../index.php', false, false, 'http://localhost/index.php'),
array('../index.php', true, false, 'http://localhost/index.php'), array('../index.php', true, false, 'http://localhost/index.php'),
array('./index.php', false, false, 'http://localhost/phpBB/index.php'), array('./index.php', false, false, 'http://localhost/phpBB/index.php'),
array('https://foobar.com\@http://localhost/phpBB', false, false, 'http://localhost/phpBB'),
array('https://foobar.com\@localhost/troll/http://localhost/', false, 'INSECURE_REDIRECT', false),
array('http://localhost.foobar.com\@localhost/troll/http://localhost/', false, 'INSECURE_REDIRECT', false),
); );
} }