use PMA\libraries\Response;
/**
* Gets core libraries and defines some variables
*/
define('PMA_MINIMUM_COMMON', true);
require_once './libraries/common.inc.php';
// Only output the http headers
$response = Response::getInstance();
$response->getHeader()->sendHttpHeaders();
$response->disable();
if (! PMA_isValid($_REQUEST['url'])
|| ! preg_match('/^https:\/\/[^\n\r]*$/', $_REQUEST['url'])
|| ! PMA_isAllowedDomain($_REQUEST['url'])
) {
PMA_sendHeaderLocation('./');
} else {
// JavaScript redirection is necessary. Because if header() is used
// then web browser sometimes does not change the HTTP_REFERER
// field and so with old URL as Referer, token also goes to
// external site.
echo "<script type='text/javascript'>
window.onload=function(){
window.location='" , Sanitize::escapeJsString($_REQUEST['url']) , "';
}
</script>";
// Display redirecting msg on screen.
// Do not display the value of $_REQUEST['url'] to avoid showing injected content
echo __('Taking you to the target site.');
<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
* URL redirector to avoid leaking Referer with some sensitive information.
*
* @package PhpMyAdmin
*/
/**
* Gets core libraries and defines some variables
*/
define('PMA_MINIMUM_COMMON', true);
require_once './libraries/common.inc.php';
/**
* JavaScript escaping.
*/
require_once './libraries/js_escape.lib.php';
if (!PMA_isValid($_GET['url']) || !preg_match('/^https?:\\/\\/[^\\n\\r]*$/', $_GET['url']) || !PMA_isAllowedDomain($_GET['url'])) {
header('Location: ' . $cfg['PmaAbsoluteUri']);
} else {
// JavaScript redirection is necessary. Because if header() is used
// then web browser sometimes does not change the HTTP_REFERER
// field and so with old URL as Referer, token also goes to
// external site.
echo "<script type='text/javascript'>\n window.onload=function(){\n window.location='" . PMA_escapeJsString($_GET['url']) . "';\n }\n </script>";
// Display redirecting msg on screen.
printf(__('Taking you to %s.'), htmlspecialchars($_GET['url']));
}
die;
/**
* Test for unserializing
*
* @param string $url URL to test
* @param mixed $expected Expected result
*
* @return void
*
* @dataProvider provideURLs
*/
function testIsAllowedDomain($url, $expected)
{
$_SERVER['SERVER_NAME'] = 'server.local';
$this->assertEquals($expected, PMA_isAllowedDomain($url));
}
