From 6f413680b172ae0b25f2509f1c7bb21405e8eaf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Mon, 23 May 2016 09:48:53 +0200
Subject: [PATCH] Backport URL redirection from later releases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- fixes token leak for browsers which do not change referer on
  Location header
- adds whitelist to avoid redirection to any domain

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/core.lib.php | 34 ++++++++++++++++++++++++++++++++++
 url.php                | 19 +++++++++++++++++--
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/libraries/core.lib.php b/libraries/core.lib.php
index e909ad9a48..730d82cb46 100644
--- a/libraries/core.lib.php
+++ b/libraries/core.lib.php
@@ -807,4 +807,38 @@ if(! function_exists('hash_equals')) {
         return ! $ret;
     }
 }
+
+/**
+ * Checks whether domain of URL is whitelisted domain or not.
+ * Use only for URLs of external sites.
+ *
+ * @param string $url URL of external site.
+ *
+ * @return boolean.True:if domain of $url is allowed domain, False:otherwise.
+ */
+function PMA_isAllowedDomain($url)
+{
+    $arr = parse_url($url);
+    $domain = $arr["host"];
+    $domainWhiteList = array(
+        /* Include current domain */
+        $_SERVER['SERVER_NAME'],
+        /* phpMyAdmin domains */
+        'wiki.phpmyadmin.net', 'www.phpmyadmin.net', 'phpmyadmin.net',
+        'docs.phpmyadmin.net',
+        /* mysql.com domains */
+        'dev.mysql.com','bugs.mysql.com',
+        /* php.net domains */
+        'php.net',
+        /* Github domains*/
+        'github.com','www.github.com',
+        /* Following are doubtful ones. */
+        'www.primebase.com','pbxt.blogspot.com'
+    );
+    if (in_array(strtolower($domain), $domainWhiteList)) {
+        return true;
+    }
+
+    return false;
+}
 ?>
diff --git a/url.php b/url.php
index 897f3529b9..82b224311b 100644
--- a/url.php
+++ b/url.php
@@ -9,15 +9,30 @@
 /**
  * Gets core libraries and defines some variables
  */
-define('PMA_MINIMUM_COMMON', True);
+define('PMA_MINIMUM_COMMON', true);
 require_once './libraries/common.inc.php';
+/**
+ * JavaScript escaping.
+ */
+require_once './libraries/js_escape.lib.php';
 
 if (! PMA_isValid($_GET['url'])
     || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
+    || ! PMA_isAllowedDomain($_GET['url'])
 ) {
     header('Location: ' . $cfg['PmaAbsoluteUri']);
 } else {
-    header('Location: ' . $_GET['url']);
+    // JavaScript redirection is necessary. Because if header() is used
+    //  then web browser sometimes does not change the HTTP_REFERER
+    //  field and so with old URL as Referer, token also goes to
+    //  external site.
+    echo "<script type='text/javascript'>
+            window.onload=function(){
+                window.location='" . PMA_escapeJsString($_GET['url']) . "';
+            }
+        </script>";
+    // Display redirecting msg on screen.
+    printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
 }
 die();
 ?>