aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs/Module/Settings/Editor.php
diff options
context:
space:
mode:
authorMario <mario@mariovavti.com>2022-03-23 18:38:03 +0000
committerMario <mario@mariovavti.com>2022-03-23 18:38:03 +0000
commita41c7caa182117b2b7b820550cc20dff8be2c0f0 (patch)
tree19611241fd496b778c2f412ab9ebcc4fb34843bd /Zotlabs/Module/Settings/Editor.php
parentbddeab3ac11efaf786ddb2a6ce3f73d8c06790ab (diff)
parentb3ca31bce7ed0dd5777458005718ba96985cbdc2 (diff)
downloadvolse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.tar.gz
volse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.tar.bz2
volse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.zip
Merge branch 'security-fixes-lfi-xss-open-redirect' into 'dev'
Security fixes See merge request hubzilla/core!2017
Diffstat (limited to 'Zotlabs/Module/Settings/Editor.php')
-rw-r--r--Zotlabs/Module/Settings/Editor.php10
1 files changed, 5 insertions, 5 deletions
diff --git a/Zotlabs/Module/Settings/Editor.php b/Zotlabs/Module/Settings/Editor.php
index cf6dd2807..85c3e69ae 100644
--- a/Zotlabs/Module/Settings/Editor.php
+++ b/Zotlabs/Module/Settings/Editor.php
@@ -11,14 +11,14 @@ class Editor {
$module = substr(strrchr(strtolower(static::class), '\\'), 1);
check_form_security_token_redirectOnErr('/settings/' . $module, 'settings_' . $module);
-
+
$features = get_module_features($module);
process_module_features_post(local_channel(), $features, $_POST);
-
+
Libsync::build_sync_packet();
- if($_POST['rpath'])
+ if(isset($_POST['rpath']) && is_local_url($_POST['rpath']))
goaway($_POST['rpath']);
return;
@@ -34,14 +34,14 @@ class Editor {
$tpl = get_markup_template("settings_module.tpl");
$o .= replace_macros($tpl, array(
- '$rpath' => $rpath,
+ '$rpath' => escape_url($rpath),
'$action_url' => 'settings/' . $module,
'$form_security_token' => get_form_security_token('settings_' . $module),
'$title' => t('Editor Settings'),
'$features' => process_module_features_get(local_channel(), $features),
'$submit' => t('Submit')
));
-
+
return $o;
}