firstgarden/firstgarden-web-gnu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

오픈 리다이렉트 유저 패스워드 Leak 취약점 수정 adm1nkyj@UpRoot님이 알려주심

Browse Source
This commit is contained in:
thisgun
2017-08-22 16:46:36 +09:00
parent 91f60763d8
commit 3d2d3b9948
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
lib/common.lib.php
View File

@ -2988,15 +2988,32 @@ function check_url_host($url, $msg='', $return_url=G5_URL)
$p = @parse_url($url);
$host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']);
$is_host_check = false;
if(stripos($url, 'http:') !== false) {
if(!isset($p['scheme']) || !$p['scheme'] || !isset($p['host']) || !$p['host'])
alert('url 정보가 올바르지 않습니다.', $return_url);
}
if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host'])) {
//php 5.6.29 이하 버전에서는 parse_url 버그가 존재함
if ( (isset($p['host']) && $p['host']) && version_compare(PHP_VERSION, '5.6.29') < 0) {
$bool_ch = false;
foreach( array('user','host') as $key) {
if ( isset( $p[ $key ] ) && strpbrk( $p[ $key ], ':/?#@' ) ) {
$bool_ch = true;
}
}
if( $bool_ch ){
$regex = '/https?\:\/\/'.$host.'/i';
if( ! preg_match($regex, $url) ){
$is_host_check = true;
}
}
}
if ((isset($p['scheme']) && $p['scheme']) || (isset($p['host']) && $p['host']) || $is_host_check) {
//if ($p['host'].(isset($p['port']) ? ':'.$p['port'] : '') != $_SERVER['HTTP_HOST']) {
if ($p['host'] != $host) {
if ( ($p['host'] != $host) || $is_host_check ) {
echo '<script>'.PHP_EOL;
echo 'alert("url에 타 도메인을 지정할 수 없습니다.");'.PHP_EOL;
echo 'document.location.href = "'.$return_url.'";'.PHP_EOL;