cvs: docweb /include lib_auth.inc.php /templates/all/www login.tpl.php /www login.php

colder		Tue Dec  5 17:53:15 2006 UTC

  Modified files:              
    /docweb/include	lib_auth.inc.php 
    /docweb/templates/all/www	login.tpl.php 
    /docweb/www	login.php 
  Log:
  Fix login's return url & improve security
  
http://cvs.php.net/viewvc.cgi/docweb/include/lib_auth.inc.php?r1=1.15&r2=1.16&diff_format=u
Index: docweb/include/lib_auth.inc.php
diff -u docweb/include/lib_auth.inc.php:1.15 docweb/include/lib_auth.inc.php:1.16
--- docweb/include/lib_auth.inc.php:1.15	Mon Dec  4 23:18:04 2006
+++ docweb/include/lib_auth.inc.php	Tue Dec  5 17:53:15 2006
@@ -17,7 +17,7 @@
  * |          Nuno Lopes <[email protected]>                                |
  * +----------------------------------------------------------------------+
  *
- * $Id: lib_auth.inc.php,v 1.15 2006/12/04 23:18:04 colder Exp $
+ * $Id: lib_auth.inc.php,v 1.16 2006/12/05 17:53:15 colder Exp $
  */
 
 require_once 'cvs-auth.inc';
@@ -52,7 +52,7 @@
 function auth()
 {
     global $user, $password;
-        $return = $_SERVER['REQUEST_URI'];
+    $return = urlencode($_SERVER['REQUEST_URI']);
         
     if (isset($_COOKIE['MAGIC_COOKIE'])) {
 
http://cvs.php.net/viewvc.cgi/docweb/templates/all/www/login.tpl.php?r1=1.1&r2=1.2&diff_format=u
Index: docweb/templates/all/www/login.tpl.php
diff -u docweb/templates/all/www/login.tpl.php:1.1 docweb/templates/all/www/login.tpl.php:1.2
--- docweb/templates/all/www/login.tpl.php:1.1	Thu Aug 10 18:20:09 2006
+++ docweb/templates/all/www/login.tpl.php	Tue Dec  5 17:53:15 2006
@@ -4,7 +4,13 @@
 
 <p>
 <form method="post" name="login" action="/login.php">
-<input type="hidden" name="return" value="<?php echo rawurlencode(@$_REQUEST['return']); ?>" />
+<input type="hidden" name="return" value="<?php
+
+    if (isset($_REQUEST['return'])) {
+        echo htmlspecialchars($_REQUEST['return']);
+    }
+
+?>" />
 <table border="0" cellspacing="2" cellpadding="2">
   <tr>
     <th>Username</th>
http://cvs.php.net/viewvc.cgi/docweb/www/login.php?r1=1.2&r2=1.3&diff_format=u
Index: docweb/www/login.php
diff -u docweb/www/login.php:1.2 docweb/www/login.php:1.3
--- docweb/www/login.php:1.2	Mon Dec  4 23:18:04 2006
+++ docweb/www/login.php	Tue Dec  5 17:53:15 2006
@@ -1,5 +1,5 @@
 <?php
-/* $Id: login.php,v 1.2 2006/12/04 23:18:04 colder Exp $ */
+/* $Id: login.php,v 1.3 2006/12/05 17:53:15 colder Exp $ */
 
 include '../include/init.inc.php';
 
@@ -7,9 +7,11 @@
     require_once '../include/lib_auth.inc.php';
     auth();
         
-        if (isset($_REQUEST['return']) && !empty($_REQUEST['return'])) {
-            header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']);
-        }
+    if (isset($_REQUEST['return']) && !empty($_REQUEST['return'])
+        && strpos($_REQUEST['return'], "\n") === false) {
+
+        header('Location: http://'.$_SERVER['HTTP_HOST'].$_REQUEST['return']);
+    }
     echo 'You are logged in';
     echo is_admin() ? ' <strong>with admin rights</strong>.' : '.';
 } else {