*/
function generateLocation($referer, $host, $loopTerms = array())
{
- $final_referer = '?';
+ $finalReferer = '?';
// No referer if it contains any value in $loopCriteria.
foreach ($loopTerms as $value) {
if (strpos($referer, $value) !== false) {
- return $final_referer;
+ return $finalReferer;
}
}
$host = substr($host, 0, $pos);
}
- if (!empty($referer) && strpos(parse_url($referer, PHP_URL_HOST), $host) !== false) {
- $final_referer = $referer;
+ $refererHost = parse_url($referer, PHP_URL_HOST);
+ if (!empty($referer) && (strpos($refererHost, $host) !== false || startsWith('?', $refererHost))) {
+ $finalReferer = $referer;
}
- return $final_referer;
-}
-
-/**
- * Checks the PHP version to ensure Shaarli can run
- *
- * @param string $minVersion minimum PHP required version
- * @param string $curVersion current PHP version (use PHP_VERSION)
- *
- * @throws Exception the PHP version is not supported
- */
-function checkPHPVersion($minVersion, $curVersion)
-{
- if (version_compare($curVersion, $minVersion) < 0) {
- throw new Exception(
- 'Your PHP version is obsolete!'
- .' Shaarli requires at least PHP '.$minVersion.', and thus cannot run.'
- .' Your PHP version has known security vulnerabilities and should be'
- .' updated as soon as possible.'
- );
- }
+ return $finalReferer;
}
/**
* Validate session ID to prevent Full Path Disclosure.
+ *
* See #298.
+ * The session ID's format depends on the hash algorithm set in PHP settings
*
* @param string $sessionId Session ID
*
* @return true if valid, false otherwise.
+ *
+ * @see http://php.net/manual/en/function.hash-algos.php
+ * @see http://php.net/manual/en/session.configuration.php
*/
function is_session_id_valid($sessionId)
{
return false;
}
- if (!preg_match('/^[a-z0-9]{2,32}$/', $sessionId)) {
+ if (!preg_match('/^[a-zA-Z0-9,-]{2,128}$/', $sessionId)) {
return false;
}