Post-fix redirect

slawkens · Apr 14, 2024 · eb0c2a7 · eb0c2a7
1 parent d225c2d
commit eb0c2a7
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/system/pages/account/manage.php b/system/pages/account/manage.php
@@ -21,6 +21,12 @@
 if(isset($_REQUEST['redirect']))
 {
 	$redirect = urldecode($_REQUEST['redirect']);
+
+	// should never happen, unless hacker modify the URL
+	if (!str_contains($redirect, BASE_URL)) {
+		error('Fatal error: Cannot redirect outside the website.');
+		return;
+	}
 
 	$twig->display('account.redirect.html.twig', array(
 		'redirect' => $redirect

diff --git a/system/pages/account/redirect.php b/system/pages/account/redirect.php
@@ -13,7 +13,7 @@
 $redirect = urldecode($_REQUEST['redirect']);
 
 // should never happen, unless hacker modify the URL
-if (!str_contains($_REQUEST['redirect'], BASE_URL)) {
+if (!str_contains($redirect, BASE_URL)) {
 	error('Fatal error: Cannot redirect outside the website.');
 	return;
 }