From b3ca31bce7ed0dd5777458005718ba96985cbdc2 Mon Sep 17 00:00:00 2001 From: Harald Eilertsen Date: Sun, 20 Mar 2022 14:37:19 +0100 Subject: CVE-2022-27256: Open redirect via rpath query param. Don't follow urls to external sites when submitting forms from the settings modules. This mitigates an Open Redirect vulnerability where an attacker could trick a user to go to an attacker controlled destination. Fixes part of https://framagit.org/hubzilla/core/-/issues/1666 --- Zotlabs/Module/Settings/Profiles.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'Zotlabs/Module/Settings/Profiles.php') diff --git a/Zotlabs/Module/Settings/Profiles.php b/Zotlabs/Module/Settings/Profiles.php index f7c7a0029..0ff2dfb6d 100644 --- a/Zotlabs/Module/Settings/Profiles.php +++ b/Zotlabs/Module/Settings/Profiles.php @@ -23,7 +23,7 @@ class Profiles { Libsync::build_sync_packet(); - if($_POST['rpath']) + if(isset($_POST['rpath']) && is_local_url($_POST['rpath'])) goaway($_POST['rpath']); return; -- cgit v1.2.3