Commit e762ff2b authored by Lukas Reschke's avatar Lukas Reschke
Browse files

Merge pull request #11356 from owncloud/redirect-only-to-the-same-domain

Redirect only to absolute URL
parents e93f98f1 6e7365fc
......@@ -847,8 +847,10 @@ class OC_Util {
*/
public static function getDefaultPageUrl() {
$urlGenerator = \OC::$server->getURLGenerator();
if (isset($_REQUEST['redirect_url'])) {
$location = urldecode($_REQUEST['redirect_url']);
// Deny the redirect if the URL contains a @
// This prevents unvalidated redirects like ?redirect_url=:user@domain.com
if (isset($_REQUEST['redirect_url']) && strpos($_REQUEST['redirect_url'], '@') === false) {
$location = $urlGenerator->getAbsoluteURL(urldecode($_REQUEST['redirect_url']));
} else {
$defaultPage = OC_Appconfig::getValue('core', 'defaultpage');
if ($defaultPage) {
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment