From abe033be855f76fde9e8576ce36460fbb23b1e57 Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Tue, 22 Sep 2020 15:17:13 +0200 Subject: Fix invalid redirection using the path of an external domain Fixes #1554 --- application/front/controller/visitor/ShaarliVisitorController.php | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'application/front/controller') diff --git a/application/front/controller/visitor/ShaarliVisitorController.php b/application/front/controller/visitor/ShaarliVisitorController.php index cd27455b..55c075a2 100644 --- a/application/front/controller/visitor/ShaarliVisitorController.php +++ b/application/front/controller/visitor/ShaarliVisitorController.php @@ -142,6 +142,13 @@ abstract class ShaarliVisitorController if (null !== $referer) { $currentUrl = parse_url($referer); + // If the referer is not related to Shaarli instance, redirect to default + if (isset($currentUrl['host']) + && strpos(index_url($this->container->environment), $currentUrl['host']) === false + ) { + return $response->withRedirect($defaultPath); + } + parse_str($currentUrl['query'] ?? '', $params); $path = $currentUrl['path'] ?? $defaultPath; } else { -- cgit v1.2.3