From 77760a84cebdcf535c3dc29a229d4e9248ce45c4 Mon Sep 17 00:00:00 2001 From: Jelmer Prins Date: Wed, 23 Mar 2022 12:39:26 +0100 Subject: [PATCH] Fix intercepting a redirect to other domain on login using // at the start of the url --- src/Backend/Modules/Authentication/Actions/Index.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/Backend/Modules/Authentication/Actions/Index.php b/src/Backend/Modules/Authentication/Actions/Index.php index 8dcdba2f98..0d0559001d 100644 --- a/src/Backend/Modules/Authentication/Actions/Index.php +++ b/src/Backend/Modules/Authentication/Actions/Index.php @@ -10,6 +10,7 @@ use Backend\Core\Engine\User; use Backend\Modules\Users\Engine\Model as BackendUsersModel; use Common\Mailer\Message; +use SpoonFilter; use Symfony\Component\HttpKernel\Exception\BadRequestHttpException; use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException; @@ -326,7 +327,10 @@ private function getAllowedModule() private function sanitizeQueryString(string $queryString, string $default): string { - if (!preg_match('/^\//', $queryString) or preg_match('/^\/[^a-zA-Z0-9.-_~]/', $queryString)) { + if (!preg_match('/^\//', $queryString) + || preg_match('/^\/\//', $queryString) + || preg_match('/^\/[^a-zA-Z0-9.-_~]/', $queryString) + ) { return $default; }