diff options
| author | Olivier Gayot <duskcoder@gmail.com> | 2018-03-12 22:57:42 +0100 |
|---|---|---|
| committer | Olivier Gayot <duskcoder@gmail.com> | 2018-03-12 22:57:42 +0100 |
| commit | a8c22829d8e8845cd4ddf4ef8b61a1ed79edfffc (patch) | |
| tree | f0ae554b863266fbe523582d1be09216436c7472 /debian/patches/fix_CVE-2015-3880.patch | |
Imported from the SVN repository
http://svn.wolffelaar.nl/wsvn/phpbb/branches/jessie/
Signed-off-by: Olivier Gayot <duskcoder@gmail.com>
Diffstat (limited to 'debian/patches/fix_CVE-2015-3880.patch')
| -rw-r--r-- | debian/patches/fix_CVE-2015-3880.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/debian/patches/fix_CVE-2015-3880.patch b/debian/patches/fix_CVE-2015-3880.patch new file mode 100644 index 0000000..320d589 --- /dev/null +++ b/debian/patches/fix_CVE-2015-3880.patch @@ -0,0 +1,32 @@ +Description: Fix possible redirection on Chrome + An insufficient check allowed users of the Google Chrome browser to be + redirected to external domains (e.g. on login). + [CVE-2015-3880] +Author: Marc Alexander <admin@m-a-styles.de>, Joas Schilling <nickvergessen@gmx.de> +Origin: upstream, https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04 +Reviewed-by: Andreas Fischer <bantu@phpbb.com> +Last-Update: 2015-05-09 +--- a/includes/functions.php ++++ b/includes/functions.php +@@ -2492,7 +2492,7 @@ + // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work) + if (!$disable_cd_check && $url_parts['host'] !== $user->host) + { +- $url = generate_board_url(); ++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR); + } + } + else if ($url[0] == '/') +@@ -2579,6 +2579,12 @@ + } + } + ++ // Make sure we don't redirect to external URLs ++ if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0) ++ { ++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR); ++ } ++ + // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2 + if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false) + { |