mirror of
https://github.com/nextcloud/server.git
synced 2024-08-22 05:55:27 +02:00
Merge pull request #11356 from owncloud/redirect-only-to-the-same-domain
Redirect only to absolute URL
This commit is contained in:
commit
e762ff2bbd
@ -847,8 +847,10 @@ class OC_Util {
|
||||
*/
|
||||
public static function getDefaultPageUrl() {
|
||||
$urlGenerator = \OC::$server->getURLGenerator();
|
||||
if (isset($_REQUEST['redirect_url'])) {
|
||||
$location = urldecode($_REQUEST['redirect_url']);
|
||||
// Deny the redirect if the URL contains a @
|
||||
// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
|
||||
if (isset($_REQUEST['redirect_url']) && strpos($_REQUEST['redirect_url'], '@') === false) {
|
||||
$location = $urlGenerator->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
|
||||
} else {
|
||||
$defaultPage = OC_Appconfig::getValue('core', 'defaultpage');
|
||||
if ($defaultPage) {
|
||||
|
Loading…
Reference in New Issue
Block a user