diff options
| author | Harald Eilertsen <haraldei@anduin.net> | 2022-03-20 14:37:19 +0100 |
|---|---|---|
| committer | Harald Eilertsen <haraldei@anduin.net> | 2022-03-20 15:34:24 +0100 |
| commit | b3ca31bce7ed0dd5777458005718ba96985cbdc2 (patch) | |
| tree | e95a34664c278c76f8c4f68fd2749c91a6d046d6 /Zotlabs/Module/Settings/Photos.php | |
| parent | b02f6a1dae3e3fae4af4b24e65256cdf653b2515 (diff) | |
| download | volse-hubzilla-b3ca31bce7ed0dd5777458005718ba96985cbdc2.tar.gz volse-hubzilla-b3ca31bce7ed0dd5777458005718ba96985cbdc2.tar.bz2 volse-hubzilla-b3ca31bce7ed0dd5777458005718ba96985cbdc2.zip | |
CVE-2022-27256: Open redirect via rpath query param.
Don't follow urls to external sites when submitting forms from the
settings modules. This mitigates an Open Redirect vulnerability where an
attacker could trick a user to go to an attacker controlled destination.
Fixes part of https://framagit.org/hubzilla/core/-/issues/1666
Diffstat (limited to 'Zotlabs/Module/Settings/Photos.php')
| -rw-r--r-- | Zotlabs/Module/Settings/Photos.php | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/Zotlabs/Module/Settings/Photos.php b/Zotlabs/Module/Settings/Photos.php index bf7481e92..f68c8847b 100644 --- a/Zotlabs/Module/Settings/Photos.php +++ b/Zotlabs/Module/Settings/Photos.php @@ -7,18 +7,18 @@ use Zotlabs\Lib\Libsync; class Photos { function post() { - + $module = substr(strrchr(strtolower(static::class), '\\'), 1); check_form_security_token_redirectOnErr('/settings/' . $module, 'settings_' . $module); - + $features = get_module_features($module); process_module_features_post(local_channel(), $features, $_POST); - + Libsync::build_sync_packet(); - if($_POST['rpath']) + if(isset($_POST['rpath']) && is_local_url($_POST['rpath'])) goaway($_POST['rpath']); return; |