diff options
Diffstat (limited to 'lib/util.php')
| -rwxr-xr-x[-rw-r--r--] | lib/util.php | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/lib/util.php b/lib/util.php index 7c85db71f5f..d1d5983dcfb 100644..100755 --- a/lib/util.php +++ b/lib/util.php @@ -332,7 +332,8 @@ class OC_Util { * Redirect to the user default page */ public static function redirectToDefaultPage(){ - if(isset($_REQUEST['redirect_url']) && substr($_REQUEST['redirect_url'], 0, strlen(OC::$WEBROOT)) == OC::$WEBROOT) { + OC_Log::write('core','redirectToDefaultPage',OC_Log::DEBUG); + if(isset($_REQUEST['redirect_url']) && (substr($_REQUEST['redirect_url'], 0, strlen(OC::$WEBROOT)) == OC::$WEBROOT || $_REQUEST['redirect_url'][0] == '/')) { header( 'Location: '.$_REQUEST['redirect_url']); } else { header( 'Location: '.OC::$WEBROOT.'/'.OC_Appconfig::getValue('core', 'defaultpage', '?app=files')); @@ -358,12 +359,30 @@ class OC_Util { * Todo: Write howto */ public static function callRegister(){ + //mamimum time before token exires + $maxtime=(60*60); // 1 hour + // generate a random token. $token=mt_rand(1000,9000).mt_rand(1000,9000).mt_rand(1000,9000); // store the token together with a timestamp in the session. $_SESSION['requesttoken-'.$token]=time(); + // cleanup old tokens garbage collector + // only run every 20th time so we donīt waste cpu cycles + if(rand(0,20)==0) { + foreach($_SESSION as $key=>$value) { + // search all tokens in the session + if(substr($key,0,12)=='requesttoken') { + if($value+$maxtime<time()){ + // remove outdated tokens + unset($_SESSION[$key]); + } + } + } + } + + // return the token return($token); } |