Changeset 670 for trunk/lib/Utilities.inc.php

Timestamp:

Mar 6, 2019 9:18:39 PM (5 years ago)

Author:

anonymous

Message:

Strip unsafe characters from HTTP_HOST

File:

• trunk/lib/Utilities.inc.php (modified) (2 diffs)

trunk/lib/Utilities.inc.php

@@ -1377 +1377 @@
 
     if (!isset($urls[$url])) {
-        if (!preg_match('|https?://[\w.]+/|', $url)) {
+        if (!preg_match('!^https?://!i', $url)) {
             // If we can't find a domain we assume the URL is local (i.e. "/my/url/path/" or "../img/file.jpg").
             $urls[$url] = true;
         } else {
-            $urls[$url] = preg_match('|https?://[\w.]*' . preg_quote(getenv('HTTP_HOST'), '|') . '|i', $url);
+            $urls[$url] = preg_match('!^https?://' . preg_quote(getenv('HTTP_HOST'), '!') . '!i', $url);
         }
     }
@@ -1405 +1405 @@
 function absoluteMe()
 {
-    return sprintf('%s://%s%s', (getenv('HTTPS') ? 'https' : 'http'), getenv('HTTP_HOST'), getenv('REQUEST_URI'));
+    $safe_http_host = preg_replace('/[^a-z\d.-]/', '', getenv('HTTP_HOST'));
+    return sprintf('%s://%s%s', (getenv('HTTPS') ? 'https' : 'http'), $safe_http_host, getenv('REQUEST_URI'));
 }