Bugzilla – Attachment 144646 Details for
Bug 31699
Add a generic way to redirect back to the page you were on at login for modal logins
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 31699: (follow-up) Protect more against open redirects
Bug-31699-follow-up-Protect-more-against-open-redi.patch (text/plain), 1.69 KB, created by
Martin Renvoize (ashimema)
on 2022-12-16 11:28:33 UTC
(
hide
)
Description:
Bug 31699: (follow-up) Protect more against open redirects
Filename:
MIME Type:
Creator:
Martin Renvoize (ashimema)
Created:
2022-12-16 11:28:33 UTC
Size:
1.69 KB
patch
obsolete
>From 43b33576740ff2421a11e1c2e6dbcadabfae0c4e Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Thu, 10 Nov 2022 00:00:37 +0000 >Subject: [PATCH] Bug 31699: (follow-up) Protect more against open redirects > >This change checks that the OPACBaseURL exists, and uses its scheme >and authority to rewrite the URL passed through the "return" >param. > >Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> >--- > opac/opac-user.pl | 20 ++++++++++++++------ > 1 file changed, 14 insertions(+), 6 deletions(-) > >diff --git a/opac/opac-user.pl b/opac/opac-user.pl >index a02e7f16acd..d787e3f6123 100755 >--- a/opac/opac-user.pl >+++ b/opac/opac-user.pl >@@ -20,6 +20,7 @@ > use Modern::Perl; > > use CGI qw ( -utf8 ); >+use URI; > > use C4::Auth qw( get_template_and_user ); > use C4::Koha qw( >@@ -428,12 +429,19 @@ if ($search_query) { > # back to the page we triggered the login from > my $return = $query->param('return'); > if ( $return ) { >- my $uri = C4::Context->preference('OPACBaseURL'); >- $uri .= $return; >- print $query->redirect( >- -uri => $uri, >- -cookie => $cookie, >- ); >+ my $uri_syspref = C4::Context->preference('OPACBaseURL'); >+ if ( $uri_syspref ){ >+ my $uri = URI->new($uri_syspref); >+ if ( $uri->isa('URI::http') && $uri->host() ){ >+ my $return_uri = URI->new($return); >+ $return_uri->scheme( $uri->scheme() ); >+ $return_uri->authority( $uri->authority() ); >+ print $query->redirect( >+ -uri => "$return_uri", >+ -cookie => $cookie, >+ ); >+ } >+ } > } > > output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 }; >-- >2.39.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 31699
:
141420
|
141421
|
142200
|
142201
|
142204
|
142205
|
142733
|
142734
|
143378
|
143463
|
143464
|
143465
|
143468
|
143469
|
143608
|
143643
|
144644
|
144645
| 144646