Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[1.x] fix: Logout controller allows open redirects #3948

Merged
merged 11 commits into from
Jan 5, 2024
Merged

[1.x] fix: Logout controller allows open redirects #3948

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
bf95872
fix: prevent open redirects on logout controller
imorland Jan 4, 2024
b363023
use clearer config key
imorland Jan 4, 2024
af0c032
cast url as string, reinstate guest redirect
imorland Jan 4, 2024
947645d
clean up a little
imorland Jan 4, 2024
743f4ea
simplify
imorland Jan 5, 2024
19168b6
return Uri
imorland Jan 5, 2024
40dfb1f
resolve ternary always true
imorland Jan 5, 2024
8d8005b
simplify some more
imorland Jan 5, 2024
2aadc5c
remove extra newline
imorland Jan 5, 2024
a1dd387
handle malformed uri
imorland Jan 5, 2024
48b5844
chore: requested changes
imorland Jan 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
handle malformed uri
  • Loading branch information
@imorland
imorland committed Jan 5, 2024
commit a1dd387bdc56179106a9bd7160476c0aca106179
6 changes: 5 additions & 1 deletion framework/core/src/Forum/Controller/LogOutController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,11 @@ protected function sanitizeReturnUrl(string $url, string $base): Uri
return new Uri($base);
}

$parsedUrl = new Uri($url);
try {
$parsedUrl = new Uri($url);
} catch (\InvalidArgumentException $e) {
return new Uri($base);
}

if (in_array($parsedUrl->getHost(), $this->getWhitelistedRedirectDomains())) {
return $parsedUrl;
Expand Down
Loading