From eed355b798ec77ed8b67555087fc5866b522c5fc Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Fri, 10 Apr 2015 18:02:58 +0200
Subject: [PATCH] [ticket/security-180] Check if redirect URL contains board
 URL

SECURITY-180
---
 phpBB/includes/functions.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index f0657b9016..f79a0a9e52 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -2579,6 +2579,12 @@ function redirect($url, $return = false, $disable_cd_check = false)
 		}
 	}
 
+	// Make sure we don't redirect to external URLs
+	if (!$disable_cd_check && strpos($url, generate_board_url(true)) !== 0)
+	{
+		trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
+	}
+
 	// Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
 	if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
 	{