From: Lukas Reschke <lukas@owncloud.com>
Date: Mon, 29 Sep 2014 15:07:43 +0000 (+0200)
Subject: Redirect only to absolute URL
X-Git-Tag: v8.0.0alpha1~581^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=6e7365fc1725fdb6868398ebb821aa44a09fb903;p=nextcloud-server.git

Redirect only to absolute URL

We do not want to redirect to other domains using the "?redirect_url=" feature. Please notice, that the ownCloud project does not consider open redirectors as security issue.
---

diff --git a/lib/private/util.php b/lib/private/util.php
index 46a61716333..4476b857e4d 100755
--- a/lib/private/util.php
+++ b/lib/private/util.php
@@ -847,8 +847,10 @@ class OC_Util {
 	 */
 	public static function getDefaultPageUrl() {
 		$urlGenerator = \OC::$server->getURLGenerator();
-		if (isset($_REQUEST['redirect_url'])) {
-			$location = urldecode($_REQUEST['redirect_url']);
+		// Deny the redirect if the URL contains a @
+		// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
+		if (isset($_REQUEST['redirect_url']) && strpos($_REQUEST['redirect_url'], '@') === false) {
+			$location = $urlGenerator->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
 		} else {
 			$defaultPage = OC_Appconfig::getValue('core', 'defaultpage');
 			if ($defaultPage) {