Fix intercepting a redirect to other domain on login using // at the …

…start of the url
forkcms · Mar 23, 2022 · 77760a8 · 77760a8
1 parent 1b38e33
commit 77760a8
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Backend/Modules/Authentication/Actions/Index.php b/src/Backend/Modules/Authentication/Actions/Index.php
@@ -10,6 +10,7 @@
 use Backend\Core\Engine\User;
 use Backend\Modules\Users\Engine\Model as BackendUsersModel;
 use Common\Mailer\Message;
+use SpoonFilter;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException;
 
@@ -326,7 +327,10 @@ private function getAllowedModule()
 
     private function sanitizeQueryString(string $queryString, string $default): string
     {
-        if (!preg_match('/^\//', $queryString) or preg_match('/^\/[^a-zA-Z0-9.-_~]/', $queryString)) {
+        if (!preg_match('/^\//', $queryString)
+            || preg_match('/^\/\//', $queryString)
+            || preg_match('/^\/[^a-zA-Z0-9.-_~]/', $queryString)
+        ) {
             return $default;
         }