Attachment 145622 Details for Bug 30979 – Bug 31699: (follow-up) Protect more against open redirects

[patch] Bug 31699: (follow-up) Protect more against open redirects

Bug-31699-follow-up-Protect-more-against-open-redi.patch (text/plain), 1.69 KB, created by Martin Renvoize (ashimema) on 2023-01-24 15:30:35 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Renvoize (ashimema)

Created: 2023-01-24 15:30:35 UTC

Size: 1.69 KB

patch

obsolete

>From 43a68f396bb4419356306be1566979a7d2b9c6b0 Mon Sep 17 00:00:00 2001
>From: David Cook <dcook@prosentient.com.au>
>Date: Thu, 10 Nov 2022 00:00:37 +0000
>Subject: [PATCH] Bug 31699: (follow-up) Protect more against open redirects
>
>This change checks that the OPACBaseURL exists, and uses its scheme
>and authority to rewrite the URL passed through the "return"
>param.
>
>Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
>---
> opac/opac-user.pl | 20 ++++++++++++++------
> 1 file changed, 14 insertions(+), 6 deletions(-)
>
>diff --git a/opac/opac-user.pl b/opac/opac-user.pl
>index a02e7f16acd..d787e3f6123 100755
>--- a/opac/opac-user.pl
>+++ b/opac/opac-user.pl
>@@ -20,6 +20,7 @@
> use Modern::Perl;
> 
> use CGI qw ( -utf8 );
>+use URI;
> 
> use C4::Auth qw( get_template_and_user );
> use C4::Koha qw(
>@@ -428,12 +429,19 @@ if ($search_query) {
> # back to the page we triggered the login from
> my $return = $query->param('return');
> if ( $return ) {
>-    my $uri = C4::Context->preference('OPACBaseURL');
>-    $uri .= $return;
>-    print $query->redirect(
>-        -uri    => $uri,
>-        -cookie => $cookie,
>-    );
>+    my $uri_syspref = C4::Context->preference('OPACBaseURL');
>+    if ( $uri_syspref ){
>+        my $uri = URI->new($uri_syspref);
>+        if ( $uri->isa('URI::http') && $uri->host() ){
>+            my $return_uri = URI->new($return);
>+            $return_uri->scheme( $uri->scheme() );
>+            $return_uri->authority( $uri->authority() );
>+            print $query->redirect(
>+                -uri    => "$return_uri",
>+                -cookie => $cookie,
>+            );
>+        }
>+    }
> }
> 
> output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
>-- 
>2.39.1

Actions: View | Diff | Splinter Review

Attachments on bug 30979: 139131 | 139132 | 139133 | 139134 | 141274 | 141275 | 141276 | 141277 | 141278 | 141279 | 141300 | 145264 | 145265 | 145266 | 145267 | 145268 | 145277 | 145280 | 145281 | 145282 | 145283 | 145284 | 145285 | 145620 | 145621 | 145622 | 145623 | 145624 | 145625 | 145626 | 145627 | 145628 | 145629 | 145630 | 150867 | 150868 | 150869 | 150870 | 150871 | 150872 | 150873 | 150874 | 150875 | 150876 | 150877 | 150878 | 150879 | 150880 | 150881 | 150882 | 150883 | 150884 | 150885 | 150886 | 150887 | 150888 | 150889 | 150967 | 150968 | 150969 | 150970 | 150971 | 150972 | 150973 | 150974 | 151254 | 151255 | 151256 | 151257 | 151258 | 151259 | 151260 | 151261 | 151358 | 151359 | 151360 | 151361 | 151362 | 151363 | 151364 | 151365 | 151368 | 151369 | 151370 | 151371 | 151372 | 151373 | 151374 | 151375 | 151376 | 152789 | 152790 | 152791 | 152792 | 152793 | 152794 | 152795 | 152796 | 152797 | 153459 | 153460 | 153461 | 153462 | 153463 | 153464 | 153465 | 153466 | 153467 | 153500 | 153501 | 153502 | 153503