From 0a542ad9f9b122a2893c2d9deec35f46de70198b Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 14 Mar 2021 11:38:42 +0100 Subject: [PATCH] Fix redirect to external website. Bad sanitizing of backtopage parameter --- htdocs/core/lib/functions.lib.php | 2 +- test/phpunit/SecurityTest.php | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 469b99dd75e..02d12c3b2d0 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -613,7 +613,7 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null // Sanitizing for special parameters. There is no reason to allow the backtopage parameter to contains an external URL. if ($paramname == 'backtopage') { $out = str_replace('\\', '/', $out); - $out = preg_replace(array('/^:*\/\/+/', '/^[a-z]*:+/i'), '', $out); + $out = preg_replace(array('/^[a-z:]*\/\/+/i'), '', $out); } // Code for search criteria persistence. diff --git a/test/phpunit/SecurityTest.php b/test/phpunit/SecurityTest.php index 5e05daa5b9f..f3ee4bdce95 100644 --- a/test/phpunit/SecurityTest.php +++ b/test/phpunit/SecurityTest.php @@ -423,6 +423,27 @@ class SecurityTest extends PHPUnit\Framework\TestCase print __METHOD__." result=".$result."\n"; $this->assertEquals(trim($_POST["param12"]), $result, 'Test a string with DOCTYPE and restricthtml'); + // Special test for GETPOST of backtopage parameter + $_POST["backtopage"]='//www.google.com'; + $result=GETPOST("backtopage"); + print __METHOD__." result=".$result."\n"; + $this->assertEquals('www.google.com', $result, 'Test for backtopage param'); + + $_POST["backtopage"]='https:https://www.google.com'; + $result=GETPOST("backtopage"); + print __METHOD__." result=".$result."\n"; + $this->assertEquals('www.google.com', $result, 'Test for backtopage param'); + + $_POST["backtopage"]='::HTTPS://www.google.com'; + $result=GETPOST("backtopage"); + print __METHOD__." result=".$result."\n"; + $this->assertEquals('www.google.com', $result, 'Test for backtopage param'); + + $_POST["backtopage"]='/mydir/mypage.php?aa=a%10a'; + $result=GETPOST("backtopage"); + print __METHOD__." result=".$result."\n"; + $this->assertEquals('/mydir/mypage.php?aa=a%10a', $result, 'Test for backtopage param'); + return $result; }