gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-11 20:21:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

encrypt referer to prevent malicious manipulation

Browse Source
This commit is contained in:
Uwe Steinmann 2025-03-03 21:42:54 +01:00
parent d66f12ae21
commit 329b54d00f
3 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
op/op.SetLanguage.php
View File

@ -31,5 +31,4 @@ include("../inc/inc.Authentication.php");
$session->setLanguage($_GET['lang']);
header("Location: http".((isset($_SERVER['HTTPS']) && (strcmp($_SERVER['HTTPS'],'off')!=0)) ? "s" : "")."://".$_SERVER['HTTP_HOST'].$_GET['referer']);
?>
header("Location: http".((isset($_SERVER['HTTPS']) && (strcmp($_SERVER['HTTPS'],'off')!=0)) ? "s" : "")."://".$_SERVER['HTTP_HOST'].decryptData($settings->_encryptionKey, $_GET['referer']));

2
views/bootstrap/class.Bootstrap.php
View File

@ -390,7 +390,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
echo "<li class=\"active\">";
else
echo "<li>";
echo "<a href=\"".$this->params['settings']->_httpRoot."op/op.SetLanguage.php?lang=".$currLang."&referer=".$_SERVER["REQUEST_URI"]."\">";
echo "<a href=\"".$this->params['settings']->_httpRoot."op/op.SetLanguage.php?lang=".$currLang."&referer=".urlencode(encryptData($this->params['settings']->_encryptionKey, $_SERVER["REQUEST_URI"]))."\">";
echo getMLText($currLang)."</a></li>\n";
}
echo " </ul>\n";

2
views/bootstrap4/class.Bootstrap4.php
View File

@ -460,7 +460,7 @@ background-image: linear-gradient(to bottom, #882222, #111111);;
echo " <a class=\"dropdown-item active\"";
else
echo " <a class=\"dropdown-item\"";
echo " href=\"".$this->params['settings']->_httpRoot."op/op.SetLanguage.php?lang=".$currLang."&referer=".$_SERVER["REQUEST_URI"]."\">";
echo " href=\"".$this->params['settings']->_httpRoot."op/op.SetLanguage.php?lang=".$currLang."&referer=".urlencode(encryptData($this->params['settings']->_encryptionKey, $_SERVER["REQUEST_URI"]))."\">";
echo getMLText($currLang)."</a>\n";
}
echo " </div>\n";