gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/master'

Browse Source
This commit is contained in:
Weblate 2014-02-08 08:09:29 +01:00
commit 1b25c79d2a
2 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libraries/core.lib.php
View File

@ -809,12 +809,12 @@ function PMA_linkURL($url)
parse_str($arr["query"], $vars);
$query = http_build_query(array("url" => $vars["url"]));
$url = './url.php?' . $query;
return $url;
}
/**
* Checks whether domain of URL is whitelisted domain or not.
* Checks whether domain of URL is whitelisted domain or not.
* Use only for URLs of external sites.
*
* @param string $url URL of external site.
@ -827,8 +827,8 @@ function PMA_isAllowedDomain($url)
$domain = $arr["host"];
$domainWhiteList = array(
/* Include current domain */
$_SERVER['SERVER_NAME'],
/* phpMyAdmin domains */
$_SERVER['SERVER_NAME'],
/* phpMyAdmin domains */
'wiki.phpmyadmin.net', 'www.phpMyAdmin.net', 'phpmyadmin.net',
'docs.phpmyadmin.net',
/* mysql.com domains */
@ -843,7 +843,7 @@ function PMA_isAllowedDomain($url)
if (in_array($domain, $domainWhiteList)) {
return true;
}
return false;
}

14
url.php
View File

@ -17,19 +17,17 @@ if (! PMA_isValid($_GET['url'])
) {
header('Location: ' . $cfg['PmaAbsoluteUri']);
} else {
// header('Location: ' . $_GET['url']);
// domain whitelist check
if (PMA_isAllowedDomain($_GET['url'])) {
// JavaScript redirection is necessary. Because if header() is used
// then web browser sometimes does not change the HTTP_REFERER
// field and so with old URL as Referer, token also goes to
// then web browser sometimes does not change the HTTP_REFERER
// field and so with old URL as Referer, token also goes to
// external site.
echo "<script type='text/javascript'>
window.onload=function(){
window.location='" . $_GET['url'] . "';
}
</script>";
window.onload=function(){
window.location='" . $_GET['url'] . "';
}
</script>";
// Display redirecting msg on screen.
echo __('Taking you to ') . ($_GET['url']);
} else {