Don't allow redirect to external website

slawkens · Apr 8, 2024 · ef62b53 · ef62b53
1 parent 7181b98
commit ef62b53
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/system/login.php b/system/login.php
@@ -42,12 +42,6 @@
 
 			$logged = false;
 			unset($account_logged);
-
-			if(isset($_REQUEST['redirect']))
-			{
-				header('Location: ' . urldecode($_REQUEST['redirect']));
-				exit;
-			}
 		}
 	}
 }

diff --git a/system/pages/accountmanagement.php b/system/pages/accountmanagement.php
@@ -52,9 +52,16 @@
 	{
 		$redirect = urldecode($_REQUEST['redirect']);
 
+		// should never happen, unless hacker modify the URL
+		if (strpos($_REQUEST['redirect'], BASE_URL) === false) {
+			error('Fatal error: Cannot redirect outside the website.');
+			return;
+		}
+
 		$twig->display('account.redirect.html.twig', array(
 			'redirect' => $redirect
 		));
+
 		return;
 	}