Verified Commit c64d26a2 authored by Luc Didry's avatar Luc Didry

Fix header injection and open redirects from referrer header

parent 72404aaf
Pipeline #83266 passed with stages
in 3 minutes and 27 seconds
......@@ -2,6 +2,7 @@
package Lufi::Controller::Misc;
use Mojo::Base 'Mojolicious::Controller';
use Mojo::File;
use Mojo::URL;
use Lufi::DB::File;
sub index {
......@@ -21,7 +22,8 @@ sub change_lang {
$c->cookie($c->app->moniker.'_lang' => $l, { path => $c->config('prefix') });
}
if ($c->req->headers->referrer) {
if ($c->req->headers->referrer
&& Mojo::URL->new($c->req->headers->referrer)->host eq $c->req->url->host) {
return $c->redirect_to($c->req->headers->referrer);
} else {
return $c->redirect_to('/');
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment