From 2a431d495127b7f942047f32b0530481537d3dbd Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sun, 28 Mar 2021 21:39:18 +0200 Subject: [PATCH] Protect backtourl from using external urls --- htdocs/core/lib/functions.lib.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index 812c14792cf..403aa59e66a 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -634,8 +634,8 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null $out = checkVal($out, $check, $filter, $options); } - // Sanitizing for special parameters. There is no reason to allow the backtopage parameter to contains an external URL. - if ($paramname == 'backtopage' || $paramname == 'backtolist') { + // Sanitizing for special parameters. There is no reason to allow the backtopage, backtolist or backtourl parameter to contains an external URL. + if ($paramname == 'backtopage' || $paramname == 'backtolist' || $paramname == 'backtourl') { $out = str_replace('\\', '/', $out); $out = str_replace(array(':', ';', '@'), '', $out);