From a8c22829d8e8845cd4ddf4ef8b61a1ed79edfffc Mon Sep 17 00:00:00 2001 From: Olivier Gayot Date: Mon, 12 Mar 2018 22:57:42 +0100 Subject: Imported from the SVN repository http://svn.wolffelaar.nl/wsvn/phpbb/branches/jessie/ Signed-off-by: Olivier Gayot --- debian/patches/fix_CVE-2015-3880.patch | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 debian/patches/fix_CVE-2015-3880.patch (limited to 'debian/patches/fix_CVE-2015-3880.patch') diff --git a/debian/patches/fix_CVE-2015-3880.patch b/debian/patches/fix_CVE-2015-3880.patch new file mode 100644 index 0000000..320d589 --- /dev/null +++ b/debian/patches/fix_CVE-2015-3880.patch @@ -0,0 +1,32 @@ +Description: Fix possible redirection on Chrome + An insufficient check allowed users of the Google Chrome browser to be + redirected to external domains (e.g. on login). + [CVE-2015-3880] +Author: Marc Alexander , Joas Schilling +Origin: upstream, https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04 +Reviewed-by: Andreas Fischer +Last-Update: 2015-05-09 +--- a/includes/functions.php ++++ b/includes/functions.php +@@ -2492,7 +2492,7 @@ + // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work) + if (!$disable_cd_check && $url_parts['host'] !== $user->host) + { +- $url = generate_board_url(); ++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR); + } + } + else if ($url[0] == '/') +@@ -2579,6 +2579,12 @@ + } + } + ++ // Make sure we don't redirect to external URLs ++ if (!$disable_cd_check && strpos($url, generate_board_url(true) . '/') !== 0) ++ { ++ trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR); ++ } ++ + // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2 + if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false) + { -- cgit v1.2.3