sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Redirect only to absolute URL 

We do not want to redirect to other domains using the "?redirect_url=" feature. Please notice, that the ownCloud project does not consider open redirectors as security issue.
remotes/origin/fix-10825
Lukas Reschke 2014-09-29 17:07:43 +07:00
parent 6b45cb5416
commit 6e7365fc17
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/private/util.php
Unescape Escape View File

@ -847,8 +847,10 @@ class OC_Util {
*/
public static function getDefaultPageUrl() {
$urlGenerator = \OC::$server->getURLGenerator();
if (isset($_REQUEST['redirect_url'])) {
$location = urldecode($_REQUEST['redirect_url']);
// Deny the redirect if the URL contains a @
// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
if (isset($_REQUEST['redirect_url']) && strpos($_REQUEST['redirect_url'], '@') === false) {
$location = $urlGenerator->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
} else {
$defaultPage = OC_Appconfig::getValue('core', 'defaultpage');
if ($defaultPage) {