From 6d2d5d7caeba2145f3165371a937141ef0d1015c Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Sat, 19 Sep 2020 00:02:38 +0200 Subject: [PATCH] Fix #yogosha4529 --- htdocs/core/lib/functions.lib.php | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index a457aa5af17..20e3dbc2646 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -606,6 +606,11 @@ function GETPOST($paramname, $check = 'alphanohtml', $method = 0, $filter = null break; } + // Sanitizing for special var name. There is no reason to allow a backtopage to an external URL. + if ($paramname == 'backtopage') { + $out = preg_replace(array('/\/\//', '/^[a-z]*:/'), '', $out); + } + // Code for search criteria persistence. // Save data into session if key start with 'search_' or is 'smonth', 'syear', 'month', 'year' if (empty($method) || $method == 3 || $method == 4)