mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #11356 from owncloud/redirect-only-to-the-same-domain 

Redirect only to absolute URL
This commit is contained in:
Lukas Reschke 2014-10-01 12:47:43 +02:00
parent e93f98f1de 6e7365fc17
commit e762ff2bbd
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/private/util.php
View File

@ -847,8 +847,10 @@ class OC_Util {
*/ */
public static function getDefaultPageUrl() { public static function getDefaultPageUrl() {
$urlGenerator = \OC::$server->getURLGenerator(); $urlGenerator = \OC::$server->getURLGenerator();
if (isset($_REQUEST['redirect_url'])) { // Deny the redirect if the URL contains a @
$location = urldecode($_REQUEST['redirect_url']); // This prevents unvalidated redirects like ?redirect_url=:user@domain.com
if (isset($_REQUEST['redirect_url']) && strpos($_REQUEST['redirect_url'], '@') === false) {
$location = $urlGenerator->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
} else { } else {
$defaultPage = OC_Appconfig::getValue('core', 'defaultpage'); $defaultPage = OC_Appconfig::getValue('core', 'defaultpage');
if ($defaultPage) { if ($defaultPage) {