dani/lemonldap-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

LEMONLDAP::NG : XSS prevention

Browse Source
This commit is contained in:
Xavier Guimard 2008-12-06 10:26:24 +00:00
parent 66c60cc416
commit 8b4f38e58c
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDA.pm
View File

@ -30,7 +30,7 @@ sub autoRedirect {
my $cookieName = $self->{cookieName};
if ( $self->{urldc}
and $self->{urldc} !~ m#https?://[^/]*$tmp/#oi
and $self->{urldc} !~ m#^https?://[^/]*$tmp/#oi
and $self->{id}
and $self->{urldc} !~ m#[\?&]?$cookieName=\w+&?#oi )
{

2
modules/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/Simple.pm
View File

@ -396,7 +396,7 @@ sub controlUrlOrigin {
$self->{urldc} = decode_base64( $self->param('url') );
# REJECT <, " and ' in URL or encoded '%' and non protected hosts
if ( $self->{urldc} =~ /(?:<|'|"|\%(?:25|3C))/
if ( $self->{urldc} =~ /(?:<|'|"|`|\%(?:25|3C|22|27|2C))/
or $self->{urldc} !~ m#^https?://$self->{reVHosts}# )
{
delete $self->{urldc};