Bug #23321 » 0015311_v2.patch
| t3lib/class.t3lib_div.php (Arbeitskopie) | ||
|---|---|---|
|
* @access public
|
||
|
*/
|
||
|
function sanitizeBackEndUrl($url = '') {
|
||
|
$whitelistPattern = '/^[a-zA-Z0-9_\/\.&=\?]+$/';
|
||
|
$whitelistPattern = '/^[a-z0-9_\/\.&=\?\+~-]+$/i';
|
||
|
if (!preg_match($whitelistPattern, $url)) {
|
||
|
$url = '';
|
||
|
}
|
||
| ... | ... | |
|
$decodedUrl = rawurldecode($url);
|
||
|
$decodedParts = @parse_url($decodedUrl);
|
||
|
$whitelistPattern = '/^(\p{Nd}|\p{L}|[_\/\.&=\?\+-~])+$/u';
|
||
|
$whitelistPattern = '/^[a-z0-9_\/\.&=\?\+~-]+$/i';
|
||
|
// Only http and https are allowed as scheme, and at least a path must be given:
|
||
|
if (isset($decodedParts['scheme']) && !t3lib_div::inList('http,https', $decodedParts['scheme']) || !isset($decodedParts['path'])) {
|
||
|
$url = '';
|
||
|
// Check all URL parts for invalid characters:
|
||
|
} else {
|
||
|
foreach ($decodedParts as $part) {
|
||
|
if (!preg_match($whitelistPattern, $part)) {
|
||
|
foreach ($decodedParts as $type => $part) {
|
||
|
if ($type != 'host' && !preg_match($whitelistPattern, $part)) {
|
||
|
$url = '';
|
||
|
break;
|
||
|
}
|
||