gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retrieve parameters from $_GET in url.php

Browse Source 
Signed-off-by: Maurício Meneghini Fauth <mauriciofauth@gmail.com>
This commit is contained in:
Maurício Meneghini Fauth 2018-11-10 17:03:48 -02:00 committed by Isaac Bennetch
parent d178f4fc46
commit d8e672a501
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
url.php
View File

@ -21,9 +21,9 @@ $response = Response::getInstance();
$response->getHeader()->sendHttpHeaders();
$response->disable();
if (! Core::isValid($_REQUEST['url'])
|| ! preg_match('/^https:\/\/[^\n\r]*$/', $_REQUEST['url'])
|| ! Core::isAllowedDomain($_REQUEST['url'])
if (! Core::isValid($_GET['url'])
|| ! preg_match('/^https:\/\/[^\n\r]*$/', $_GET['url'])
|| ! Core::isAllowedDomain($_GET['url'])
) {
Core::sendHeaderLocation('./');
} else {
@ -33,11 +33,11 @@ if (! Core::isValid($_REQUEST['url'])
// external site.
echo "<script type='text/javascript'>
window.onload=function(){
window.location='" , Sanitize::escapeJsString($_REQUEST['url']) , "';
window.location='" , Sanitize::escapeJsString($_GET['url']) , "';
}
</script>";
// Display redirecting msg on screen.
// Do not display the value of $_REQUEST['url'] to avoid showing injected content
// Do not display the value of $_GET['url'] to avoid showing injected content
echo __('Taking you to the target site.');
}
die();