From b384952dee29d006a3827a97a45cd698e3ed9c89 Mon Sep 17 00:00:00 2001 From: Meik Sievertsen Date: Fri, 17 Oct 2008 10:31:20 +0000 Subject: [PATCH] Disable referer validation on install if it is not possible to determine correct referer due to a proxy setup (Bug #32765) git-svn-id: file:///svn/phpbb/branches/phpBB-3_0_0@9024 89ea8834-ac86-4346-8a33-228a782c2dd0 --- phpBB/install/install_install.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/phpBB/install/install_install.php b/phpBB/install/install_install.php index 991d1d02a6..72de32f303 100644 --- a/phpBB/install/install_install.php +++ b/phpBB/install/install_install.php @@ -1118,6 +1118,7 @@ class install_install extends module // HTTP_HOST is having the correct browser url in most cases... $server_name = (!empty($_SERVER['HTTP_HOST'])) ? strtolower($_SERVER['HTTP_HOST']) : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME')); + $referer = (!empty($_SERVER['HTTP_REFERRER'])) ? strtolower($_SERVER['HTTP_REFERRER']) : getenv('HTTP_REFERRER'); // HTTP HOST can carry a port number... if (strpos($server_name, ':') !== false) @@ -1376,6 +1377,15 @@ class install_install extends module WHERE config_name = 'captcha_gd'"; } + $ref = substr($referer, strpos($referer, '://') + 3); + + if (!(stripos($ref, $server_name) === 0)) + { + $sql_ary[] = 'UPDATE ' . $data['table_prefix'] . "config + SET config_value = '0' + WHERE config_name = 'referer_validation'"; + } + // We set a (semi-)unique cookie name to bypass login issues related to the cookie name. $cookie_name = 'phpbb3_'; $rand_str = md5(mt_rand());