*/
function generateLocation($referer, $host, $loopTerms = array())
{
- $final_referer = '?';
+ $finalReferer = '?';
// No referer if it contains any value in $loopCriteria.
foreach ($loopTerms as $value) {
if (strpos($referer, $value) !== false) {
- return $final_referer;
+ return $finalReferer;
}
}
$host = substr($host, 0, $pos);
}
- if (!empty($referer) && strpos(parse_url($referer, PHP_URL_HOST), $host) !== false) {
- $final_referer = $referer;
+ $refererHost = parse_url($referer, PHP_URL_HOST);
+ if (!empty($referer) && (strpos($refererHost, $host) !== false || startsWith('?', $refererHost))) {
+ $finalReferer = $referer;
}
- return $final_referer;
+ return $finalReferer;
}
/**
/**
* Validate session ID to prevent Full Path Disclosure.
+ *
* See #298.
+ * The session ID's format depends on the hash algorithm set in PHP settings
*
* @param string $sessionId Session ID
*
* @return true if valid, false otherwise.
+ *
+ * @see http://php.net/manual/en/function.hash-algos.php
+ * @see http://php.net/manual/en/session.configuration.php
*/
function is_session_id_valid($sessionId)
{
return false;
}
- if (!preg_match('/^[a-z0-9]{2,32}$/', $sessionId)) {
+ if (!preg_match('/^[a-zA-Z0-9,-]{2,128}$/', $sessionId)) {
return false;
}