phpBB.de

Code: Alles auswählen

	/**
	* Check if the request originated from the same page.
	* @param bool $check_script_path If true, the path will be checked as well
	*/
	function validate_referer($check_script_path = false)
	{
		global $config;
		
		// no referer - nothing to validate, user's fault for turning it off (we only check on POST; so meta can't be the reason)
		if (empty($this->referer) || empty($this->host))
		{
			return true;
		}

		$host = htmlspecialchars($this->host);
		$path = rtrim($this->page['root_script_path'], '/');
		
		// if set in the configuration, might be different...
		if($config['force_server_vars'])
		{
			$host=htmlspecialchars($config['server_name']);
			$path=$config['script_path'];
		}
		$ref = substr($this->referer, strpos($this->referer, '://') + 3);
		if (!(stripos($ref, $host) === 0))
		{

			return false;
		}
		else if ($check_script_path && $path !== '')
		{
			$ref = substr($ref, strlen($host));
			$server_port = (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');

			if ($server_port !== 80 && $server_port !== 443 && stripos($ref, ":$server_port") === 0)
			{
				$ref = substr($ref, strlen(":$server_port"));
			}

			if (!(stripos(rtrim($ref, '/'), $path) === 0))
			{
				return false;
			}
		}

		return true;
	}

Code: Alles auswählen

function redirect($url, $return = false, $disable_cd_check = false)
{
	global $db, $cache, $config, $user, $phpbb_root_path;

	if (empty($user->lang))
	{
		$user->add_lang('common');
	}

	if (!$return)
	{
		garbage_collection();
	}

	// Make sure no &'s are in, this will break the redirect
	$url = str_replace('&', '&', $url);

	// Determine which type of redirect we need to handle...
	$url_parts = parse_url($url);

	if ($url_parts === false)
	{
		// Malformed url, redirect to current page...
		$url = generate_board_url() . '/' . $user->page['page'];
	}
	else if (!empty($url_parts['scheme']) && !empty($url_parts['host']))
	{
		// Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work)
		//Fix: user->host might be different from generate_board_url() if force_server_vars is set
		$host=parse_url(generate_board_url(),PHP_URL_HOST);
		if (!$disable_cd_check && $url_parts['host'] !== $host)
		{
			$url = generate_board_url();
		}
	}
// ... danach alles wie vorher...