Attachment 143708 Details for Bug 31028 – Bug 31699: (follow-up) Protect more against open redirects

[patch] Bug 31699: (follow-up) Protect more against open redirects

Bug-31699-follow-up-Protect-more-against-open-redi.patch (text/plain), 1.75 KB, created by David Nind on 2022-11-10 20:40:24 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Nind

Created: 2022-11-10 20:40:24 UTC

Size: 1.75 KB

patch

obsolete

>From 4094b28b17e28586f95e2b9ae15c4674257e2968 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 10 Nov 2022 00:00:37 +0000
>Subject: [PATCH] Bug 31699: (follow-up) Protect more against open redirects
>
>This change checks that the OPACBaseURL exists, and uses its scheme
>and authority to rewrite the URL passed through the "return"
>param.
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>
>https://bugs.koha-community.org/show_bug.cgi?id=31028
>---
> opac/opac-user.pl | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
>diff --git a/opac/opac-user.pl b/opac/opac-user.pl
>index a02e7f16ac..d787e3f612 100755
>--- a/opac/opac-user.pl
>+++ b/opac/opac-user.pl
>@@ -20,6 +20,7 @@
> use Modern::Perl;
> 
> use CGI qw ( -utf8 );
>+use URI;
> 
> use C4::Auth qw( get_template_and_user );
> use C4::Koha qw(
>@@ -428,12 +429,19 @@ if ($search_query) {
> # back to the page we triggered the login from
> my $return = $query->param('return');
> if ( $return ) {
>-    my $uri = C4::Context->preference('OPACBaseURL');
>-    $uri .= $return;
>-    print $query->redirect(
>-        -uri    => $uri,
>-        -cookie => $cookie,
>-    );
>+    my $uri_syspref = C4::Context->preference('OPACBaseURL');
>+    if ( $uri_syspref ){
>+        my $uri = URI->new($uri_syspref);
>+        if ( $uri->isa('URI::http') && $uri->host() ){
>+            my $return_uri = URI->new($return);
>+            $return_uri->scheme( $uri->scheme() );
>+            $return_uri->authority( $uri->authority() );
>+            print $query->redirect(
>+                -uri    => "$return_uri",
>+                -cookie => $cookie,
>+            );
>+        }
>+    }
> }
> 
> output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
>-- 
>2.30.2

Actions: View | Diff | Splinter Review

Attachments on bug 31028: 137412 | 139222 | 139223 | 139224 | 139225 | 139226 | 139227 | 139228 | 139229 | 139230 | 139231 | 139232 | 139233 | 139234 | 139235 | 139236 | 139237 | 139238 | 139572 | 139573 | 139574 | 139575 | 139576 | 139577 | 139578 | 139579 | 139580 | 139581 | 139582 | 139583 | 139584 | 139585 | 139586 | 139587 | 139588 | 139589 | 139590 | 139591 | 140289 | 140290 | 140291 | 140292 | 140293 | 140294 | 140295 | 140296 | 140297 | 140298 | 140299 | 140300 | 140301 | 140302 | 140303 | 140304 | 140305 | 140306 | 140307 | 140308 | 140436 | 140437 | 140438 | 140439 | 140440 | 140441 | 140442 | 140443 | 140444 | 140445 | 140446 | 140447 | 140448 | 140449 | 140450 | 140451 | 140452 | 140453 | 140454 | 140455 | 140764 | 140765 | 140766 | 140767 | 140768 | 140769 | 140770 | 140771 | 140772 | 140773 | 140774 | 140775 | 140776 | 140777 | 140778 | 140779 | 140780 | 140781 | 140782 | 140783 | 140793 | 140929 | 140930 | 140931 | 140932 | 140933 | 140934 | 140935 | 140936 | 140937 | 140938 | 140939 | 140940 | 140941 | 140942 | 140943 | 140944 | 140945 | 140946 | 140947 | 140948 | 140949 | 140950 | 141133 | 141134 | 141135 | 141136 | 141137 | 141138 | 141139 | 141140 | 141141 | 141142 | 141143 | 141144 | 141145 | 141146 | 141147 | 141148 | 141149 | 141150 | 141151 | 141152 | 141153 | 141154 | 141440 | 141441 | 141442 | 141443 | 141444 | 141445 | 141446 | 141447 | 141448 | 141449 | 141450 | 141451 | 141452 | 141453 | 141454 | 141455 | 141456 | 141457 | 141458 | 141459 | 141460 | 142164 | 142165 | 142166 | 142167 | 142168 | 142169 | 142170 | 142171 | 142172 | 142173 | 142174 | 142175 | 142177 | 142179 | 142180 | 142181 | 142182 | 142183 | 142184 | 142185 | 142186 | 142187 | 142188 | 142189 | 142190 | 142191 | 142616 | 142617 | 142618 | 142619 | 142620 | 142621 | 142622 | 142623 | 142624 | 142625 | 142626 | 142627 | 142932 | 142933 | 142934 | 142935 | 142936 | 142937 | 142938 | 142939 | 142940 | 142941 | 142942 | 142943 | 142944 | 142945 | 142946 | 142947 | 142948 | 142949 | 143238 | 143239 | 143240 | 143241 | 143242 | 143243 | 143244 | 143245 | 143246 | 143247 | 143248 | 143249 | 143250 | 143251 | 143252 | 143253 | 143254 | 143255 | 143256 | 143257 | 143302 | 143303 | 143304 | 143305 | 143306 | 143307 | 143308 | 143309 | 143310 | 143311 | 143312 | 143313 | 143314 | 143315 | 143316 | 143317 | 143318 | 143319 | 143320 | 143321 | 143322 | 143323 | 143324 | 143325 | 143326 | 143327 | 143328 | 143329 | 143330 | 143331 | 143332 | 143333 | 143334 | 143335 | 143336 | 143337 | 143338 | 143339 | 143340 | 143341 | 143470 | 143471 | 143472 | 143473 | 143474 | 143475 | 143476 | 143477 | 143478 | 143479 | 143480 | 143481 | 143482 | 143483 | 143484 | 143485 | 143486 | 143487 | 143488 | 143489 | 143490 | 143647 | 143648 | 143649 | 143650 | 143651 | 143652 | 143653 | 143654 | 143655 | 143656 | 143657 | 143658 | 143659 | 143660 | 143661 | 143662 | 143663 | 143664 | 143665 | 143666 | 143667 | 143708 | 143709 | 143710 | 143711 | 143712 | 143713 | 143714 | 143715 | 143716 | 143717 | 143718 | 143719 | 143720 | 143721 | 143722 | 143723 | 143724 | 143725 | 143726 | 143727 | 144647 | 144648 | 144649 | 144650 | 144651 | 144652 | 144653 | 144654 | 144655 | 144656 | 144657 | 144658 | 144659 | 144660 | 144661 | 144662 | 144663 | 144664 | 144665 | 144666 | 144667 | 144668 | 145542 | 146214 | 146215 | 146216 | 146217 | 146218 | 146219 | 146220 | 146221 | 146222 | 146223 | 146224 | 146225 | 146226 | 146227 | 146228 | 146229 | 146230 | 146231 | 146232 | 146233 | 146234 | 146235 | 146236 | 146237 | 146238 | 146239 | 146240 | 146241 | 146242 | 146243 | 146244 | 146245 | 146246 | 146247 | 146248 | 146249 | 146250 | 146251 | 146252 | 146253 | 146254 | 146255 | 146256 | 146257 | 146258 | 146259 | 146260 | 146261 | 146262 | 146697 | 146870 | 146871 | 146872 | 146873 | 146874 | 146875 | 146876 | 146877 | 146878 | 146879 | 146880 | 146881 | 146882 | 146883 | 146884 | 146885 | 146886 | 146887 | 146888 | 146889 | 146890 | 146891 | 146892 | 146893 | 146894 | 146895 | 146896 | 147797 | 147840 | 147841 | 147844 | 147859 | 147860 | 147861 | 147866 | 148673 | 149931