Changeset 544

Show
Ignore:
Timestamp:
09/13/06 14:25:58 (2 years ago)
Author:
ben
Message:

More secure URL redirection for logins.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • devel/login/index.php

    r541 r544  
    77 
    88$redirect_url = trim(optional_param('passthru_url')); 
    9 if (empty($redirect_url)) { 
     9if (empty($redirect_url) || substr_count($redirect_url,$CFG->wwwroot) == 0) { 
    1010    $redirect_url = $CFG->wwwroot . "index.php"; 
    1111} 
    12 /* 
    13     TODO: Find a more useful way to restrict redirects to 
    14     the valid Elgg domain name. 
    1512 
    1613if (substr_count($redirect_url,$CFG->wwwroot) == 0) { 
    1714    $redirect_url = substr($CFG->wwwroot,0,strlen($CFG->wwwroot) - 1) . $redirect_url; 
    1815} 
    19 */ 
     16 
     17$redirect_url = str_replace("@","",$redirect_url); 
    2018 
    2119// if we're already logged in, redirect away again. 

  • devel/units/display/function_log_on_pane.php

    r517 r544  
    3131                        <label>' . gettext("Password") . '&nbsp;<input type="password" name="password" id="password" style="size: 200px" /> 
    3232                        </label> 
    33                         <input type="hidden" name="passthru_url" value="'. $_SERVER['REQUEST_URI'] .'" /> 
     33                        <input type="hidden" name="passthru_url" value="'. substr($CFG->wwwroot,0,strlen($CFG->wwwroot) - 1) . $_SERVER['REQUEST_URI'] .'" /> 
    3434                        </p> 
    3535                    </td>