Backport URL redirection from later releases

- fixes token leak for browsers which do not change referer on
  Location header
- adds whitelist to avoid redirection to any domain

Signed-off-by: Michal Čihař <michal@cihar.com>

libraries/core.lib.php

@@ -807,4 +807,38 @@ if(! function_exists('hash_equals')) {
         return ! $ret;
     }
 }
+
+/**
+ * Checks whether domain of URL is whitelisted domain or not.
+ * Use only for URLs of external sites.
+ *
+ * @param string $url URL of external site.
+ *
+ * @return boolean.True:if domain of $url is allowed domain, False:otherwise.
+ */
+function PMA_isAllowedDomain($url)
+{
+    $arr = parse_url($url);
+    $domain = $arr["host"];
+    $domainWhiteList = array(
+        /* Include current domain */
+        $_SERVER['SERVER_NAME'],
+        /* phpMyAdmin domains */
+        'wiki.phpmyadmin.net', 'www.phpmyadmin.net', 'phpmyadmin.net',
+        'docs.phpmyadmin.net',
+        /* mysql.com domains */
+        'dev.mysql.com','bugs.mysql.com',
+        /* php.net domains */
+        'php.net',
+        /* Github domains*/
+        'github.com','www.github.com',
+        /* Following are doubtful ones. */
+        'www.primebase.com','pbxt.blogspot.com'
+    );
+    if (in_array(strtolower($domain), $domainWhiteList)) {
+        return true;
+    }
+
+    return false;
+}
 ?>

url.php

@@ -9,15 +9,30 @@
 /**
  * Gets core libraries and defines some variables
  */
-define('PMA_MINIMUM_COMMON', True);
+define('PMA_MINIMUM_COMMON', true);
 require_once './libraries/common.inc.php';
+/**
+ * JavaScript escaping.
+ */
+require_once './libraries/js_escape.lib.php';
 
 if (! PMA_isValid($_GET['url'])
     || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
+    || ! PMA_isAllowedDomain($_GET['url'])
 ) {
     header('Location: ' . $cfg['PmaAbsoluteUri']);
 } else {
-    header('Location: ' . $_GET['url']);
+    // JavaScript redirection is necessary. Because if header() is used
+    //  then web browser sometimes does not change the HTTP_REFERER
+    //  field and so with old URL as Referer, token also goes to
+    //  external site.
+    echo "<script type='text/javascript'>
+            window.onload=function(){
+                window.location='" . PMA_escapeJsString($_GET['url']) . "';
+            }
+        </script>";
+    // Display redirecting msg on screen.
+    printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
 }
 die();
 ?>