diff options
| author | Michael Gapczynski <GapczynskiM@gmail.com> | 2012-05-19 00:56:15 +0400 |
|---|---|---|
| committer | Michael Gapczynski <GapczynskiM@gmail.com> | 2012-05-19 00:56:48 +0400 |
| commit | 90cbc32c77bb213bb9064645bdbd69ce7791f6c7 (patch) | |
| tree | d10e5dbd56a3f50d47b95d333833e945c1c0cb9d /index.php | |
| parent | e03b5ff6653ca7334f24bf2000eacdbad4c99bf8 (diff) | |
Fix redirect after login, prevent open redirects
Diffstat (limited to 'index.php')
| -rw-r--r-- | index.php | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/index.php b/index.php index 94b9def0b41..690fc90e752 100644 --- a/index.php +++ b/index.php @@ -117,6 +117,7 @@ elseif(OC_User::isLoggedIn()) { if(!array_key_exists('sectoken', $_SESSION) || (array_key_exists('sectoken', $_SESSION) && is_null(OC::$REQUESTEDFILE)) || substr(OC::$REQUESTEDFILE, -3) == 'php'){ $sectoken=rand(1000000,9999999); $_SESSION['sectoken']=$sectoken; - OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => substr($_SERVER['REQUEST_URI'], 1))); + $redirect_url = (isset($_REQUEST['redirect_url'])) ? $_REQUEST['redirect_url'] : $_SERVER['REQUEST_URI']; + OC_Template::printGuestPage('', 'login', array('error' => $error, 'sectoken' => $sectoken, 'redirect' => $redirect_url)); } } |