diff options
| author | Mario <mario@mariovavti.com> | 2022-03-23 18:38:03 +0000 |
|---|---|---|
| committer | Mario <mario@mariovavti.com> | 2022-03-23 18:38:03 +0000 |
| commit | a41c7caa182117b2b7b820550cc20dff8be2c0f0 (patch) | |
| tree | 19611241fd496b778c2f412ab9ebcc4fb34843bd /Zotlabs/Module/Settings/Editor.php | |
| parent | bddeab3ac11efaf786ddb2a6ce3f73d8c06790ab (diff) | |
| parent | b3ca31bce7ed0dd5777458005718ba96985cbdc2 (diff) | |
| download | volse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.tar.gz volse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.tar.bz2 volse-hubzilla-a41c7caa182117b2b7b820550cc20dff8be2c0f0.zip | |
Merge branch 'security-fixes-lfi-xss-open-redirect' into 'dev'
Security fixes
See merge request hubzilla/core!2017
Diffstat (limited to 'Zotlabs/Module/Settings/Editor.php')
| -rw-r--r-- | Zotlabs/Module/Settings/Editor.php | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/Zotlabs/Module/Settings/Editor.php b/Zotlabs/Module/Settings/Editor.php index cf6dd2807..85c3e69ae 100644 --- a/Zotlabs/Module/Settings/Editor.php +++ b/Zotlabs/Module/Settings/Editor.php @@ -11,14 +11,14 @@ class Editor { $module = substr(strrchr(strtolower(static::class), '\\'), 1); check_form_security_token_redirectOnErr('/settings/' . $module, 'settings_' . $module); - + $features = get_module_features($module); process_module_features_post(local_channel(), $features, $_POST); - + Libsync::build_sync_packet(); - if($_POST['rpath']) + if(isset($_POST['rpath']) && is_local_url($_POST['rpath'])) goaway($_POST['rpath']); return; @@ -34,14 +34,14 @@ class Editor { $tpl = get_markup_template("settings_module.tpl"); $o .= replace_macros($tpl, array( - '$rpath' => $rpath, + '$rpath' => escape_url($rpath), '$action_url' => 'settings/' . $module, '$form_security_token' => get_form_security_token('settings_' . $module), '$title' => t('Editor Settings'), '$features' => process_module_features_get(local_channel(), $features), '$submit' => t('Submit') )); - + return $o; } |