cvs: docweb /include lib_auth.inc.php /templates/all/www login.tpl.php /www login.php

colder Tue Dec 5 17:53:15 2006 UTC Modified files: /docweb/include lib_auth.inc.php /docweb/templates/all/www login.tpl.php /docweb/www login.php Log: Fix login's return url & improve security http://cvs.php.net/viewvc.cgi/docweb/include/lib_auth.inc.php?r1=1.15&r2=1.16&diff_format=u Index: docweb/include/lib_auth.inc.php diff -u docweb/include/lib_auth.inc.php:1.15 docweb/include/lib_auth.inc.php:1.16 --- docweb/include/lib_auth.inc.php:1.15 Mon Dec 4 23:18:04 2006 +++ docweb/include/lib_auth.inc.php Tue Dec 5 17:53:15 2006 @@ -17,7 +17,7 @@ * | Nuno Lopes <nlopess@php.net> | * +----------------------------------------------------------------------+ * - * $Id: lib_auth.inc.php,v 1.15 2006/12/04 23:18:04 colder Exp $ + * $Id: lib_auth.inc.php,v 1.16 2006/12/05 17:53:15 colder Exp $ */ require_once 'cvs-auth.inc'; @@ -52,7 +52,7 @@ function auth() { global $user, $password; - $return = $_SERVER['REQUEST_URI']; + $return = urlencode($_SERVER['REQUEST_URI']); if (isset($_COOKIE['MAGIC_COOKIE'])) { http://cvs.php.net/viewvc.cgi/docweb/templates/all/www/login.tpl.php?r1=1.1&r2=1.2&diff_format=u Index: docweb/templates/all/www/login.tpl.php diff -u docweb/templates/all/www/login.tpl.php:1.1 docweb/templates/all/www/login.tpl.php:1.2 --- docweb/templates/all/www/login.tpl.php:1.1 Thu Aug 10 18:20:09 2006 +++ docweb/templates/all/www/login.tpl.php Tue Dec 5 17:53:15 2006 @@ -4,7 +4,13 @@ <p> <form method="post" name="login" action="/login.php"> -<input type="hidden" name="return" value="<?php echo rawurlencode(@$_REQUEST['return']); ?>" /> +<input type="hidden" name="return" value="<?php + + if (isset($_REQUEST['return'])) { + echo htmlspecialchars($_REQUEST['return']); + } + +?>" /> <table border="0" cellspacing="2" cellpadding="2"> <tr> <th>Username</th> http://cvs.php.net/viewvc.cgi/docweb/www/login.php?r1=1.2&r2=1.3&diff_format=u Index: docweb/www/login.php diff -u docweb/www/login.php:1.2 docweb/www/login.php:1.3 --- docweb/www/login.php:1.2 Mon Dec 4 23:18:04 2006 +++ docweb/www/login.php Tue Dec 5 17:53:15 2006 @@ -1,5 +1,5 @@ <?php -/* $Id: login.php,v 1.2 2006/12/04 23:18:04 colder Exp $ */ +/* $Id: login.php,v 1.3 2006/12/05 17:53:15 colder Exp $ */ include '../include/init.inc.php'; @@ -7,9 +7,11 @@ require_once '../include/lib_auth.inc.php'; auth(); - if (isset($_REQUEST['return']) && !empty($_REQUEST['return'])) { - header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']); - } + if (isset($_REQUEST['return']) && !empty($_REQUEST['return']) + && strpos($_REQUEST['return'], "\n") === false) { + + header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']); + } echo 'You are logged in'; echo is_admin() ? ' <strong>with admin rights</strong>.' : '.'; } else {