tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Take redirects off the Host header.

Browse Source 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
publish/addeditor.php
+4 -6
View File
@@ -1,15 +1,13 @@
<?php
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
exit;
}
require_once('../config.lib.php');
require_https();
require_once("../session.lib.php");
$added = FALSE;
$csrf_failed = FALSE;
$hash_failed = FALSE;
$exists = FALSE;
if (!isset($_SESSION['editor'])) {
header("Location: https://xxx.org.za/publish/login");
header("Location: /publish/login");
return;
} else if (isset($_POST['adduser']) && !csrf_valid()) {
$csrf_failed = TRUE;
@@ -73,7 +71,7 @@ if (!isset($_SESSION['editor'])) {
<p><strong>The editor was not added: the editors.password column is too short for the password hash. Widen it to VARCHAR(255).</strong></p>
<?php } ?>
<form action="<?= form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']) ?>" method="post">
<form action="" method="post">
<?= csrf_field() ?>
<div class="grid">
publish/edit.php
+3 -5
View File
@@ -1,13 +1,11 @@
<?php
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
exit;
}
require_once('../config.lib.php');
require_https();
require_once("../session.lib.php");
if (!isset($_SESSION['editor'])) {
$is_admin = FALSE;
session_write_close();
header("Location: https://xxx.org.za/publish/login");
header("Location: /publish/login");
return;
}
?>
publish/index.php
+2 -4
View File
@@ -1,8 +1,6 @@
<?php
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
exit;
}
require_once('../config.lib.php');
require_https();
require_once("../session.lib.php");
?>
<!DOCTYPE html>
publish/login.php
+12 -19
View File
@@ -1,8 +1,6 @@
<?php
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
exit;
}
require_once('../config.lib.php');
require_https();
require_once("../session.lib.php");
$denied = NULL;
$wait_minutes = 0;
@@ -10,7 +8,7 @@ $captcha_failed = FALSE;
$is_admin = NULL;
if (isset($_SESSION['editor'])) {
session_write_close();
header("Location: https://xxx.org.za/publish/edit");
header("Location: /publish/edit");
return;
} else if (isset($_POST['login']) && !csrf_valid()) {
$denied = TRUE;
@@ -51,19 +49,14 @@ if (isset($_SESSION['editor'])) {
if (isset($_POST['remember'])) {
create_persistent_login($username);
}
if (isset($_SESSION['referrer'])) {
$url = $_SERVER['HTTPS'] ? "https://" : "http://";
$url .= $_SERVER['HTTP_HOST'];
$url .= $_SESSION['referrer'];
unset($_SESSION['referrer']);
session_write_close();
header("Location: $url");
return;
} else {
session_write_close();
header("Location: https://xxx.org.za/publish/edit");
return;
}
$referrer = (string)($_SESSION['referrer'] ?? '');
unset($_SESSION['referrer']);
session_write_close();
if (is_local_path($referrer))
header('Location: ' . $referrer);
else
header("Location: /publish/edit");
return;
}
}
@@ -100,7 +93,7 @@ else if ($denied)
echo "<p><strong>Access denied. Please try again.</strong></p>\n";
?>
<form action="<?php echo form_value("https://xxx.org.za".$_SERVER['REQUEST_URI']); ?>" method="post">
<form action="" method="post">
<?= csrf_field() ?>
<div class="grid">
publish/logout.php
+10 -19
View File
@@ -4,13 +4,11 @@ header( 'Cache-Control: no-store, no-cache, must-revalidate' );
header( 'Cache-Control: post-check=0, pre-check=0', false );
header( 'Pragma: no-cache' );
include_once('../session.lib.php');
if ( ! isset($_SERVER['HTTPS'])) {
header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
exit;
}
require_once('../config.lib.php');
require_https();
// Only log out from our own logout link, which carries the CSRF token
if (!csrf_valid($_GET['token'] ?? '')) {
header("Location: https://xxx.org.za/");
header("Location: /");
exit;
}
if (isset($_SESSION['editor'])) {
@@ -30,18 +28,11 @@ if (isset($_SESSION['editor'])) {
session_destroy();
}
delete_persistent_login();
if (isset($_SESSION['referrer'])) {
$url = $_SERVER['HTTPS'] ? "https://" : "http://";
$url .= $_SERVER['HTTP_HOST'];
$url .= $_SESSION['referrer'];
unset($_SESSION['referrer']);
if (preg_match("/logout(\.php)?$/i", $url)) {
$url = "/";
}
header("Location: $url");
return;
} else {
header("Location: https://xxx.org.za/");
return;
}
$referrer = (string)($_SESSION['referrer'] ?? '');
unset($_SESSION['referrer']);
if (is_local_path($referrer) && !preg_match("/logout(\.php)?$/i", $referrer))
header('Location: ' . $referrer);
else
header("Location: /");
return;
?>