updated

fixed domain url from config to prevent open redirect issue and encoded uri
itflow-org · May 3, 2024 · bab66bf · bab66bf
1 parent b8c529c
commit bab66bf
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 4 deletions.
diff --git a/check_login.php b/check_login.php
@@ -21,7 +21,7 @@
     if($_SERVER["REQUEST_URI"] == "/")
         header("Location: login.php");
     else
-        header("Location: login.php?url=".urlencode($_SERVER["REQUEST_SCHEME"] . "://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]) );
+        header("Location: login.php?last_visited=" . base64_encode($_SERVER["REQUEST_URI"]) );
     exit;
 }
 
@@ -87,4 +87,3 @@
 //if ($session_user_config_force_mfa == 1 && $session_token == NULL) {
 //    header("Location: force_mfa.php");
 //}
-
diff --git a/login.php b/login.php
@@ -218,8 +218,8 @@
                 //}
 
             }
-            if($_GET['url'])
-                header("Location: ".$_GET['url']);
+            if($_GET['last_visited'])
+                header("Location: ".$_SERVER["REQUEST_SCHEME"] . "://" . $config_base_url . base64_decode($_GET['last_visited']) );
             else
                 header("Location: $config_start_page");