nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make redirector require valid token

Browse Source
This commit is contained in:
Michal Čihař
2011-05-20 09:01:20 +02:00
parent 32d8446e01
commit ecfc8ba4f7
3 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libraries/common.inc.php
View File

@@ -477,8 +477,6 @@ if (! PMA_isValid($_REQUEST['token']) || $_SESSION[' PMA_token '] != $_REQUEST['
'media_type', 'custom_type', 'bs_reference', 'media_type', 'custom_type', 'bs_reference',
/* for changing BLOB repository file MIME type */ /* for changing BLOB repository file MIME type */
'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type', 'bs_db', 'bs_table', 'bs_ref', 'bs_new_mime_type',
/* URL redirector */
'url'
); );
/** /**
* Require cleanup functions * Require cleanup functions

7
libraries/core.lib.php
View File

@@ -681,12 +681,15 @@ function PMA_array_remove($path, &$array)
* @return string URL for a link. * @return string URL for a link.
*/ */
function PMA_linkURL($url) { function PMA_linkURL($url) {
$params = array();
$params['url'] = $url;
$goto = 'url.php' . PMA_generate_common_url($params);
if (!preg_match('#^https?://#', $url)) { if (!preg_match('#^https?://#', $url)) {
return $url; return $url;
} elseif (defined('PMA_SETUP')) { } elseif (defined('PMA_SETUP')) {
return '../url.php?url=' . $url; return '../' . $goto;
} else { } else {
return './url.php?url=' . $url; return './' . $goto;
} }
} }

6
url.php
View File

@@ -3,16 +3,14 @@
* URL redirector to avoid leaking Referer with some sensitive information. * URL redirector to avoid leaking Referer with some sensitive information.
*/ */
define('PMA_MINIMUM_COMMON', TRUE);
/** /**
* Gets core libraries and defines some variables * Gets core libraries and defines some variables
*/ */
require_once './libraries/common.inc.php'; require_once './libraries/common.inc.php';
if (empty($GLOBALS['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $GLOBALS['url'])) { if (! PMA_isValid($_GET['url']) || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])) {
header('Location: ' . $cfg['PmaAbsoluteUri']); header('Location: ' . $cfg['PmaAbsoluteUri']);
} else { } else {
header('Location: ' . $GLOBALS['url']); header('Location: ' . $_GET['url']);
} }
?> ?>