Skip to content
Snippets Groups Projects
Commit b48a6abb authored by Peter Rotich's avatar Peter Rotich
Browse files

Add CSRF ( and open redirect) protection

parent d16d8c18
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
l.php
+ 3
− 2
View file @ b48a6abb
...@@ -14,8 +14,9 @@ ...@@ -14,8 +14,9 @@
vim: expandtab sw=4 ts=4 sts=4: vim: expandtab sw=4 ts=4 sts=4:
**********************************************************************/ **********************************************************************/
require 'secure.inc.php'; require 'secure.inc.php';
$url = trim($_GET['url']); //Basic url validation + token check.
if (!$url || !Validator::is_url($url)) exit('Invalid url'); if (!($url=trim($_GET['url'])) || !Validator::is_url($url) || !$ost->validateLinkToken($_GET['auth']))
exit('Invalid url');
?> ?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html> <html>
......
scp/l.php
+ 3
− 2
View file @ b48a6abb
...@@ -14,8 +14,9 @@ ...@@ -14,8 +14,9 @@
vim: expandtab sw=4 ts=4 sts=4: vim: expandtab sw=4 ts=4 sts=4:
**********************************************************************/ **********************************************************************/
require_once 'staff.inc.php'; require_once 'staff.inc.php';
$url = trim($_GET['url']); //Basic url validation + token check.
if (!$url || !Validator::is_url($url)) exit('Invalid url'); if (!($url=trim($_GET['url'])) || !Validator::is_url($url) || !$ost->validateLinkToken($_GET['auth']))
exit('Invalid url');
?> ?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html> <html>
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment